huntrule

Windows SMBClient Connectivity: Failed Outbound SMB Connection Attempts to Internet-Facing Servers

Identifies Windows SMB client failures to connect to external SMB servers by correlating specific SMB connectivity event IDs with non-private remote addresses.

FreeReviewedSigma · Medium · v5
Product
windows
Service
smbclient-connectivity
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-04-05
Updated
2026-07-31
AnalysisDetection
title: "Windows SMBClient Connectivity: Failed Outbound SMB Connection Attempts to Internet-Facing Servers"
id: 7fe43811-4ac0-4b3e-aa05-52059dc8096f
status: test
description: This rule identifies failed outbound connection attempts from a Windows SMB client to SMB servers, focusing on network connection failures and related SMB session behavior. Attackers commonly probe or attempt exploitation by reaching external SMB services, and repeated failed connection attempts can be an indicator of such activity. It relies on Windows SMB client connectivity event IDs 30803, 30804, and 30806 while filtering out private, loopback, and link-local address ranges using fields such as ServerAddress, Address, and RemoteAddress.
references:
  - https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/
  - https://github.com/nasbench/Misc-Research/blob/fc46f6da34ff7e0076da28fd3e66d6e1100f1c2f/ETW/Microsoft-Windows-SMBClient.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-23397/win_smbclient_connectivity_exploit_cve_2023_23397_outlook_remote_file.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-05
modified: 2025-10-13
tags:
  - attack.exfiltration
  - cve.2023-23397
  - detection.emerging-threats
logsource:
  product: windows
  service: smbclient-connectivity
detection:
  selection:
    EventID:
      - 30803
      - 30804
      - 30806
  filter_main_local_ips:
    - ServerAddress|cidr:
        - 10.0.0.0/8
        - 127.0.0.0/8
        - 169.254.0.0/16
        - 172.16.0.0/12
        - 192.168.0.0/16
        - ::1/128
        - fe80::/10
        - fc00::/7
    - Address|startswith:
        - "10."
        - "127."
        - 169.254.
        - "172."
        - 192.168.
        - ::1
        - "fe80::"
        - "fc00::"
    - Address|contains:
        - "00000000000000000000000000000001"
        - FE80000000000000
        - FC00000000000000
        - 0200????C0A8
        - 0200????AC
        - 0200????0A
        - 0200????7F
        - 0200????A9FE
    - ServerAddress|contains:
        - "00000000000000000000000000000001"
        - FE80000000000000
        - FC00000000000000
        - 0200????C0A8
        - 0200????AC
        - 0200????0A
        - 0200????7F
        - 0200????A9FE
    - RemoteAddress|contains:
        - "00000000000000000000000000000001"
        - FE80000000000000
        - FC00000000000000
        - 0200????C0A8
        - 0200????AC
        - 0200????0A
        - 0200????7F
        - 0200????A9FE
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Some false positives may occur from external trusted servers. Apply additional filters accordingly
level: medium
license: DRL-1.1
related:
  - id: de96b824-02b0-4241-9356-7e9b47f04bac
    type: derived