Skip to content

Hide Navigation Hide TOC

External Remote SMB Logon from Public IP (78d5cab4-557e-454f-9fb9-a222bd0d5edc)

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

Cluster A Galaxy A Cluster B Galaxy B Level
External Remote Services - T1133 (10d51417-ee35-4589-b1ff-b6df1c334e8d) Attack Pattern External Remote SMB Logon from Public IP (78d5cab4-557e-454f-9fb9-a222bd0d5edc) Sigma-Rules 1
External Remote SMB Logon from Public IP (78d5cab4-557e-454f-9fb9-a222bd0d5edc) Sigma-Rules Valid Accounts - T1078 (b17a1a56-e99c-403c-8948-561df0cffe81) Attack Pattern 1
External Remote SMB Logon from Public IP (78d5cab4-557e-454f-9fb9-a222bd0d5edc) Sigma-Rules Brute Force - T1110 (a93494bb-4b80-4ea1-8695-3236a49916fd) Attack Pattern 1