Windows SMBClient Connectivity: Failed Outbound SMB Connection Attempts to Internet-Facing Servers
Identifies Windows SMB client failures to connect to external SMB servers by correlating specific SMB connectivity event IDs with non-private remote addresses.
FreeReviewedSigma · Medium · v5
- Product
- windows
- Service
- smbclient-connectivity
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-05
- Updated
- 2026-07-31
What it detects
This rule identifies failed outbound connection attempts from a Windows SMB client to SMB servers, focusing on network connection failures and related SMB session behavior. Attackers commonly probe or attempt exploitation by reaching external SMB services, and repeated failed connection attempts can be an indicator of such activity. It relies on Windows SMB client connectivity event IDs 30803, 30804, and 30806 while filtering out private, loopback, and link-local address ranges using fields such as ServerAddress, Address, and RemoteAddress.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/
- github.comhttps://github.com/nasbench/Misc-Research/blob/fc46f6da34ff7e0076da28fd3e66d6e1100f1c2f/ETW/Microsoft-Windows-SMBClient.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-23397/win_smbclient_connectivity_exploit_cve_2023_23397_outlook_remote_file.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-smb-client-failed-smb-session-network-connections-to-internet-facing-ser-de96b824
title: "Windows SMBClient Connectivity: Failed Outbound SMB Connection Attempts to Internet-Facing Servers"
id: 7fe43811-4ac0-4b3e-aa05-52059dc8096f
status: test
description: This rule identifies failed outbound connection attempts from a Windows SMB client to SMB servers, focusing on network connection failures and related SMB session behavior. Attackers commonly probe or attempt exploitation by reaching external SMB services, and repeated failed connection attempts can be an indicator of such activity. It relies on Windows SMB client connectivity event IDs 30803, 30804, and 30806 while filtering out private, loopback, and link-local address ranges using fields such as ServerAddress, Address, and RemoteAddress.
references:
- https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/
- https://github.com/nasbench/Misc-Research/blob/fc46f6da34ff7e0076da28fd3e66d6e1100f1c2f/ETW/Microsoft-Windows-SMBClient.md
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-23397/win_smbclient_connectivity_exploit_cve_2023_23397_outlook_remote_file.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-05
modified: 2025-10-13
tags:
- attack.exfiltration
- cve.2023-23397
- detection.emerging-threats
logsource:
product: windows
service: smbclient-connectivity
detection:
selection:
EventID:
- 30803
- 30804
- 30806
filter_main_local_ips:
- ServerAddress|cidr:
- 10.0.0.0/8
- 127.0.0.0/8
- 169.254.0.0/16
- 172.16.0.0/12
- 192.168.0.0/16
- ::1/128
- fe80::/10
- fc00::/7
- Address|startswith:
- "10."
- "127."
- 169.254.
- "172."
- 192.168.
- ::1
- "fe80::"
- "fc00::"
- Address|contains:
- "00000000000000000000000000000001"
- FE80000000000000
- FC00000000000000
- 0200????C0A8
- 0200????AC
- 0200????0A
- 0200????7F
- 0200????A9FE
- ServerAddress|contains:
- "00000000000000000000000000000001"
- FE80000000000000
- FC00000000000000
- 0200????C0A8
- 0200????AC
- 0200????0A
- 0200????7F
- 0200????A9FE
- RemoteAddress|contains:
- "00000000000000000000000000000001"
- FE80000000000000
- FC00000000000000
- 0200????C0A8
- 0200????AC
- 0200????0A
- 0200????7F
- 0200????A9FE
condition: selection and not 1 of filter_main_*
falsepositives:
- Some false positives may occur from external trusted servers. Apply additional filters accordingly
level: medium
license: DRL-1.1
related:
- id: de96b824-02b0-4241-9356-7e9b47f04bac
type: derived