Windows SMB Client Security: Rejected Guest Logon with Blank UserName

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1110.001Password Guessing
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows SMB client security events indicating a rejected logon attempt where the UserName field is empty (guest-like) and the ServerName starts with a backslash-prefixed pattern. Attackers may probe SMB endpoints using atypical or unauthenticated guest patterns to elicit responses or set up follow-on access attempts. It relies on Event ID 31017 telemetry from the Windows SMB client security log, including UserName and ServerName fields.

Reporting behind it

Related detections4 linkedT1110.001 — drag to rearrange

Suspicious Bruteforce via Password Reset (via security)

Suspicious sshpass Noninteractive SSH Password Authentication (via process_creation)

Windows PowerShell Credential Guessing via LDAP using System.Net.NetworkCredential

Windows Process Creation: Hydra Password Bruteforce Command-Line Parameters

Windows SMB Client Security: Rejected Guest Logon with Blank UserName

Pivot detection · T1110.001 · 4 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-smb-client-security-rejected-guest-logon-with-blank-username-71886b70

title: "Windows SMB Client Security: Rejected Guest Logon with Blank UserName"
id: e67b98b3-c15b-44af-a5bd-ecb3e07c1988
status: test
description: This rule flags Windows SMB client security events indicating a rejected logon attempt where the UserName field is empty (guest-like) and the ServerName starts with a backslash-prefixed pattern. Attackers may probe SMB endpoints using atypical or unauthenticated guest patterns to elicit responses or set up follow-on access attempts. It relies on Event ID 31017 telemetry from the Windows SMB client security log, including UserName and ServerName fields.
references:
  - https://twitter.com/KevTheHermit/status/1410203844064301056
  - https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/
  - https://web.archive.org/web/20210701042336/https://github.com/afwu/PrintNightmare
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/smbclient/security/win_smbclient_security_susp_failed_guest_logon.yml
author: Florian Roth (Nextron Systems), KevTheHermit, fuzzyf10w, Huntrule Team
date: 2021-06-30
modified: 2023-01-02
tags:
  - attack.credential-access
  - attack.t1110.001
logsource:
  product: windows
  service: smbclient-security
detection:
  selection:
    EventID: 31017
    UserName: ""
    ServerName|startswith: \1
  condition: selection
falsepositives:
  - Account fallback reasons (after failed login with specific account)
level: medium
license: DRL-1.1
related:
  - id: 71886b70-d7b4-4dbf-acce-87d2ca135262
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL