Windows Successful SMB Logon (Event ID 4624 LogonType 3) From Public IPs

title: Windows Successful SMB Logon (Event ID 4624 LogonType 3) From Public IPs
id: 927cf823-ac79-4428-b6b6-50374e977c84
related:
  - id: 259a9cdf-c4dd-4fa2-b243-2269e5ab18a2
    type: derived
  - id: 78d5cab4-557e-454f-9fb9-a222bd0d5edc
    type: derived
status: test
description: This rule identifies successful Windows logon events (Event ID 4624) with LogonType 3 where the source IP is not a local/private/routable range and is not missing. Such activity can indicate inbound access to an externally exposed SMB service, which is a common starting point for credential access and persistence attempts. It relies on Windows Security auditing fields, specifically EventID 4624, LogonType, and IpAddress, to determine whether the source address is public-facing.
references:
  - https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html
  - https://twitter.com/Purp1eW0lf/status/1616144561965002752
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_successful_external_remote_smb_login.yml
author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity), Huntrule Team
date: 2023-01-19
modified: 2024-03-11
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.credential-access
  - attack.stealth
  - attack.t1133
  - attack.t1078
  - attack.t1110
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 3
  filter_main_local_ranges:
    IpAddress|cidr:
      - ::1/128
      - 10.0.0.0/8
      - 127.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - fc00::/7
      - fe80::/10
  filter_main_empty:
    IpAddress: "-"
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate or intentional inbound connections from public IP addresses on the SMB port.
level: high
license: DRL-1.1