Windows SMB Server: Share Access Without Signing or Encryption (Event 4000)

Alert on SMB share connections (IPC$/ADMIN$/C$) where signing and encryption are both reported as disabled.

FreeUnreviewedSigmamediumv1

windows-smb-server-share-access-without-signing-or-encryption-event-4000-8d91f6e4

title: "Windows SMB Server: Share Access Without Signing or Encryption (Event 4000)"
id: 1cc70007-0e2f-4a71-afb8-10061cb5c88e
status: experimental
description: This rule flags Windows SMB server connections to administrative or interprocess shares (IPC$, ADMIN$, C$, indicated by ShareName containing these values) when the session reports SigningUsed=false and EncyptionUsed=false. Unsecured SMB sessions can enable attackers to perform or support lateral movement by reducing the protections on SMB traffic. It relies on SMB server connectivity event telemetry (EventID 4000) with fields for ShareName, SigningUsed, EncyptionUsed, and ClientAddress to exclude likely local or private addressing patterns.
author: Mohamed Abdelghani, Huntrule Team
date: 2025-10-19
references:
  - https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/overview-server-message-block-signing
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/smbserver/connectivity/win_smbserver_connectivity_unsigned_and_unencrypted_share_connection.yml
tags:
  - attack.lateral-movement
  - attack.t1021.002
logsource:
  product: windows
  service: smbserver-connectivity
detection:
  selection_shares:
    EventID: 4000
    ShareName|contains:
      - IPC$
      - ADMIN$
      - C$
  selection_status:
    - SigningUsed: "false"
    - EncyptionUsed: "false"
  filter_main_local_ips:
    - ClientAddress|cidr:
        - 127.0.0.0/8
        - 169.254.0.0/16
        - ::1/128
        - fe80::/10
        - fc00::/7
    - ClientAddress|contains:
        - "00000000000000000000000000000001"
        - FE80000000000000
        - FC00000000000000
        - 0200????7F
        - 0200????A9FE
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Connections from local or private IP addresses to SMB shares without signing or encryption enabled for older systems or misconfigured environments. Apply additional tuning as needed.
level: medium
license: DRL-1.1
related:
  - id: 8d91f6e4-9f3b-4c21-ae41-2c5b7d9f7a12
    type: derived

What it detects

This rule flags Windows SMB server connections to administrative or interprocess shares (IPC$, ADMIN$, C$, indicated by ShareName containing these values) when the session reports SigningUsed=false and EncyptionUsed=false. Unsecured SMB sessions can enable attackers to perform or support lateral movement by reducing the protections on SMB traffic. It relies on SMB server connectivity event telemetry (EventID 4000) with fields for ShareName, SigningUsed, EncyptionUsed, and ClientAddress to exclude likely local or private addressing patterns.

Known false positives

Connections from local or private IP addresses to SMB shares without signing or encryption enabled for older systems or misconfigured environments. Apply additional tuning as needed.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.