Windows SMB Client: Failed SMB Session Network Connections to Internet-Facing Servers

Identifies Windows SMB client failures to connect to external SMB servers by correlating specific SMB connectivity event IDs with non-private remote addresses.

FreeUnreviewedSigmamediumv1

windows-smb-client-failed-smb-session-network-connections-to-internet-facing-ser-de96b824

title: "Windows SMB Client: Failed SMB Session Network Connections to Internet-Facing Servers"
id: 7fe43811-4ac0-4b3e-aa05-52059dc8096f
status: test
description: This rule flags failed SMB client connectivity events where the client attempts to establish, disconnect, or re-establish an SMB network session with a server outside private address ranges. Such failed outbound connection attempts can indicate scanning or opportunistic exploitation attempts against externally reachable SMB services. It relies on Windows SMB client connectivity event telemetry (specific SMB-related event IDs) and uses local IP and address-pattern filtering to reduce internal/loopback noise.
references:
  - https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/
  - https://github.com/nasbench/Misc-Research/blob/fc46f6da34ff7e0076da28fd3e66d6e1100f1c2f/ETW/Microsoft-Windows-SMBClient.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-23397/win_smbclient_connectivity_exploit_cve_2023_23397_outlook_remote_file.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-05
modified: 2025-10-13
tags:
  - attack.exfiltration
  - cve.2023-23397
  - detection.emerging-threats
logsource:
  product: windows
  service: smbclient-connectivity
detection:
  selection:
    EventID:
      - 30803
      - 30804
      - 30806
  filter_main_local_ips:
    - ServerAddress|cidr:
        - 10.0.0.0/8
        - 127.0.0.0/8
        - 169.254.0.0/16
        - 172.16.0.0/12
        - 192.168.0.0/16
        - ::1/128
        - fe80::/10
        - fc00::/7
    - Address|startswith:
        - "10."
        - "127."
        - 169.254.
        - "172."
        - 192.168.
        - ::1
        - "fe80::"
        - "fc00::"
    - Address|contains:
        - "00000000000000000000000000000001"
        - FE80000000000000
        - FC00000000000000
        - 0200????C0A8
        - 0200????AC
        - 0200????0A
        - 0200????7F
        - 0200????A9FE
    - ServerAddress|contains:
        - "00000000000000000000000000000001"
        - FE80000000000000
        - FC00000000000000
        - 0200????C0A8
        - 0200????AC
        - 0200????0A
        - 0200????7F
        - 0200????A9FE
    - RemoteAddress|contains:
        - "00000000000000000000000000000001"
        - FE80000000000000
        - FC00000000000000
        - 0200????C0A8
        - 0200????AC
        - 0200????0A
        - 0200????7F
        - 0200????A9FE
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Some false positives may occur from external trusted servers. Apply additional filters accordingly
level: medium
license: DRL-1.1
related:
  - id: de96b824-02b0-4241-9356-7e9b47f04bac
    type: derived

What it detects

This rule flags failed SMB client connectivity events where the client attempts to establish, disconnect, or re-establish an SMB network session with a server outside private address ranges. Such failed outbound connection attempts can indicate scanning or opportunistic exploitation attempts against externally reachable SMB services. It relies on Windows SMB client connectivity event telemetry (specific SMB-related event IDs) and uses local IP and address-pattern filtering to reduce internal/loopback noise.

Known false positives

Some false positives may occur from external trusted servers. Apply additional filters accordingly

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.