Detection rules › Kusto
Corelight - Forced External Outbound SMB
'Detects SMB requests that originate internally and communicate with an external IP address.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access |
Rule body
id: 73f23aa2-5cc4-4507-940b-75c9092e9e01
name: Corelight - Forced External Outbound SMB
description: |
'Detects SMB requests that originate internally and communicate with an external IP address.'
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: Corelight
dataTypes:
- Corelight_v2_conn
- Corelight_v2_conn_red
- corelight_conn
- corelight_conn_red
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- CredentialAccess
relevantTechniques:
- T1187
query: |
union corelight_conn, corelight_conn_red
| where local_orig == true
| where local_resp == false
| where history hasprefix 'Sh' and service hasprefix 'smb'
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: id_orig_h
version: 2.1.0
kind: Scheduled
Stages and Predicates
Stage 1: union
union of 2 branches
Stage 2: source
corelight_conn
Stage 3: source
corelight_conn_red
Stage 4: where
where local_orig =~ true
Stage 5: where
where local_resp =~ false
Stage 6: where
where history startswith "Sh" and service startswith "smb"
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
history | starts_with |
| field:"history" kind:starts_with value:"Sh" |
local_orig | eq |
| field:"local_orig" kind:eq value:"true" |
local_resp | eq |
| field:"local_resp" kind:eq value:"false" |
service | starts_with |
| field:"service" kind:starts_with value:"smb" |