Windows SMB Client Security: Rejected Guest Logon with Blank Username

Flags rejected SMB guest/anonymous-style logons on Windows when the SMB username is blank.

FreeUnreviewedSigmamediumv1

windows-smb-client-security-rejected-guest-logon-with-blank-username-71886b70

title: "Windows SMB Client Security: Rejected Guest Logon with Blank Username"
id: e67b98b3-c15b-44af-a5bd-ecb3e07c1988
status: test
description: This rule flags SMB client security events where a logon is rejected and the username field is blank, with the server name beginning with the guest/anonymous identifier prefix. Attackers may use guest-style or malformed authentication attempts to probe access boundaries or to test credential handling behavior. The detection relies on Windows SMB client security telemetry, specifically EventID 31017, plus the presence of an empty UserName and a ServerName prefix match.
references:
  - https://twitter.com/KevTheHermit/status/1410203844064301056
  - https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/
  - https://web.archive.org/web/20210701042336/https://github.com/afwu/PrintNightmare
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/smbclient/security/win_smbclient_security_susp_failed_guest_logon.yml
author: Florian Roth (Nextron Systems), KevTheHermit, fuzzyf10w, Huntrule Team
date: 2021-06-30
modified: 2023-01-02
tags:
  - attack.credential-access
  - attack.t1110.001
logsource:
  product: windows
  service: smbclient-security
detection:
  selection:
    EventID: 31017
    UserName: ""
    ServerName|startswith: \1
  condition: selection
falsepositives:
  - Account fallback reasons (after failed login with specific account)
level: medium
license: DRL-1.1
related:
  - id: 71886b70-d7b4-4dbf-acce-87d2ca135262
    type: derived

What it detects

This rule flags SMB client security events where a logon is rejected and the username field is blank, with the server name beginning with the guest/anonymous identifier prefix. Attackers may use guest-style or malformed authentication attempts to probe access boundaries or to test credential handling behavior. The detection relies on Windows SMB client security telemetry, specifically EventID 31017, plus the presence of an empty UserName and a ServerName prefix match.

Known false positives

Account fallback reasons (after failed login with specific account)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.