Submission Date: 2013/01/25

Update Date:

Information Domain: Network

Data Subtypes: PCAP

Analytic Type: Situational Awareness

Applicable Platforms: N/A

Contributors: MITRE



Server Message Block (SMB) is used by Windows to allow for file, pipe, and printer sharing over port 445/tcp. It allows for enumerating, and reading from and writing to file shares for a remote computer. Although it is heavily used by Windows servers for legitimate purposes and by users for file and printer sharing, many adversaries also use SMB to achieve Lateral Movement. Looking at this activity more closely to obtain an adequate sense of situational awareness may make it possible to detect adversaries moving between hosts in a way that deviates from normal activity. Because SMB traffic is heavy in many environments, this analytic may be difficult to turn into something that can be used to quickly detect an APT. In some cases, it may make more sense to run this analytic in a forensic fashion. Looking through and filtering its output after an intrusion has been discovered may be helpful in identifying the scope of compromise.

Output Description

The source, destination, content, and time of each event.

ATT&CK Detections

Technique Subtechnique(s) Tactic(s) Level of Coverage
Data from Network Shared Drive N/A Collection Moderate
Remote Services SMB/Windows Admin Shares Lateral Movement Moderate

D3FEND Techniques

ID Name
D3-IPCTA IPC Traffic Analysis

Data Model References

Object Action Field
flow message dest_port
flow message proto_info

Implementations

Pseudocode

Although there may be more native ways to detect detailed SMB events on the host, they can be extracted out of network traffic. With the right protocol decoders, port 445 traffic can be filtered and even the file path (relative to the share) can be retrieved.

flow = search Flow:Message
smb_events = filter flow where (dest_port == "445" and protocol == "smb")
smb_events.file_name = smb_events.proto_info.file_name
output smb_write