Situational AwarenessCAR-2013-09-003
SMB Session Setups
Hypothesis and description
Account usage within SMB can be used to identify compromised credentials, and the hosts accessed with them.
This analytic monitors SMB activity that deals with user activity rather than file activity.
- Platforms
- Not stated
- Domain
- Network
- Subtypes
- PCAP
- Submitted
- 2013-09-12
- Contributors
- MITRE
ATT&CK coverage
| Technique | Tactics | Coverage |
|---|---|---|
| T1187 Forced Authentication | Credential Access | Low |
1 technique. Links open MITRE ATT&CK.
D3FEND techniques MITRE maps to this analytic
Data model references
Fields from the CAR data model (object/action/field) the analytic reads.
Pseudocode and implementations
Pseudocode
flow = search Flow:Message
smb_setup = filter flow where (dest_port == 445 and protocol == smb.setup)
smb_setup.user = smb_write.proto_info.user_name
smb_setup.target_host = smb_write.proto_info.hostname
output smb_writeAcross MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-AEMApplication Exception Monitoring1 shared
- D3-OPMOperational Process Monitoring1 shared
- D3-CFContent Filtering1 shared
- D3-CMContent Modification1 shared
- D3-DFDecoy File1 shared
- D3-FAFile Analysis1 shared
- D3-FEFile Encryption1 shared
- D3-FEVFile Eviction1 shared
- D3-FIMFile Integrity Monitoring1 shared
- D3-LFPLocal File Permissions1 shared
- D3-RFAMRemote File Access Mediation1 shared
- D3-RFRestore File1 shared