Windows SMB Server Share Connection Without Signing or Encryption
Alert on SMB share connections (IPC$/ADMIN$/C$) where signing and encryption are both reported as disabled.
- Product
- windows
- Service
- smbserver-connectivity
- Author
- Mohamed Abdelghani (SigmaHQ), DRL 1.1
- Published
- 2025-10-19
- Updated
- 2026-07-31
ATT&CK techniques
Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags SMB server connections to specific shares where message signing is not used and encryption is not enabled. Such unsecured SMB sessions can make it easier for an attacker to access administrative or interprocess shares and perform lateral movement or other follow-on activity. It relies on Windows SMB server connectivity events (EventID 4000) containing share name, signing status, encryption status, and client address fields for local/IP filtering.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/overview-server-message-block-signing
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/smbserver/connectivity/win_smbserver_connectivity_unsigned_and_unencrypted_share_connection.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows SMB Server Share Connection Without Signing or Encryption
id: 1cc70007-0e2f-4a71-afb8-10061cb5c88e
status: experimental
description: This rule flags SMB server connections to specific shares where message signing is not used and encryption is not enabled. Such unsecured SMB sessions can make it easier for an attacker to access administrative or interprocess shares and perform lateral movement or other follow-on activity. It relies on Windows SMB server connectivity events (EventID 4000) containing share name, signing status, encryption status, and client address fields for local/IP filtering.
author: Mohamed Abdelghani, Huntrule Team
date: 2025-10-19
references:
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/overview-server-message-block-signing
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/smbserver/connectivity/win_smbserver_connectivity_unsigned_and_unencrypted_share_connection.yml
tags:
- attack.lateral-movement
- attack.t1021.002
logsource:
product: windows
service: smbserver-connectivity
detection:
selection_shares:
EventID: 4000
ShareName|contains:
- IPC$
- ADMIN$
- C$
selection_status:
- SigningUsed: "false"
- EncyptionUsed: "false"
filter_main_local_ips:
- ClientAddress|cidr:
- 127.0.0.0/8
- 169.254.0.0/16
- ::1/128
- fe80::/10
- fc00::/7
- ClientAddress|contains:
- "00000000000000000000000000000001"
- FE80000000000000
- FC00000000000000
- 0200????7F
- 0200????A9FE
condition: all of selection_* and not 1 of filter_main_*
falsepositives:
- Connections from local or private IP addresses to SMB shares without signing or encryption enabled for older systems or misconfigured environments. Apply additional tuning as needed.
level: medium
license: DRL-1.1
related:
- id: 8d91f6e4-9f3b-4c21-ae41-2c5b7d9f7a12
type: derived