Windows Successful SMB Logon (Event ID 4624 Logon Type 3) From Public IPs
Flags successful Windows SMB (LogonType 3) logons from non-private, non-local source IP addresses.
- Product
- windows
- Service
- security
- Author
- Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity) (SigmaHQ), DRL 1.1
- Published
- 2023-01-19
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Cred AccessRecon
Resource Dev
Initial Access
Execution
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies successful Windows logons using SMB (LogonType 3) where the source IP is not one of the local/private or otherwise excluded ranges and is not empty. Attackers may use network SMB authentication from the internet after initial access or during lateral movement, so public-facing SMB logons are a high-signal indicator. It relies on Windows Security Event ID 4624 telemetry and the event fields for LogonType and source IpAddress.
Reporting behind it
- inversecos.comhttps://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html
- twitter.comhttps://twitter.com/Purp1eW0lf/status/1616144561965002752
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_successful_external_remote_smb_login.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Successful SMB Logon (Event ID 4624 Logon Type 3) From Public IPs
id: 927cf823-ac79-4428-b6b6-50374e977c84
related:
- id: 259a9cdf-c4dd-4fa2-b243-2269e5ab18a2
type: derived
- id: 78d5cab4-557e-454f-9fb9-a222bd0d5edc
type: derived
status: test
description: This rule identifies successful Windows logons using SMB (LogonType 3) where the source IP is not one of the local/private or otherwise excluded ranges and is not empty. Attackers may use network SMB authentication from the internet after initial access or during lateral movement, so public-facing SMB logons are a high-signal indicator. It relies on Windows Security Event ID 4624 telemetry and the event fields for LogonType and source IpAddress.
references:
- https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html
- https://twitter.com/Purp1eW0lf/status/1616144561965002752
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_successful_external_remote_smb_login.yml
author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity), Huntrule Team
date: 2023-01-19
modified: 2024-03-11
tags:
- attack.privilege-escalation
- attack.persistence
- attack.initial-access
- attack.credential-access
- attack.stealth
- attack.t1133
- attack.t1078
- attack.t1110
logsource:
product: windows
service: security
detection:
selection:
EventID: 4624
LogonType: 3
filter_main_local_ranges:
IpAddress|cidr:
- ::1/128
- 10.0.0.0/8
- 127.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 169.254.0.0/16
- fc00::/7
- fe80::/10
filter_main_empty:
IpAddress: "-"
condition: selection and not 1 of filter_main_*
falsepositives:
- Legitimate or intentional inbound connections from public IP addresses on the SMB port.
level: high
license: DRL-1.1