Skip to content

Hide Navigation Hide TOC

Unsigned or Unencrypted SMB Connection to Share Established (8d91f6e4-9f3b-4c21-ae41-2c5b7d9f7a12)

Detects SMB server connections to shares without signing or encryption enabled. This could indicate potential lateral movement activity using unsecured SMB shares.

Cluster A Galaxy A Cluster B Galaxy B Level
Unsigned or Unencrypted SMB Connection to Share Established (8d91f6e4-9f3b-4c21-ae41-2c5b7d9f7a12) Sigma-Rules SMB/Windows Admin Shares - T1021.002 (4f9ca633-15c5-463c-9724-bdcd54fde541) Attack Pattern 1
Remote Services - T1021 (54a649ff-439a-41a4-9856-8d144a2551ba) Attack Pattern SMB/Windows Admin Shares - T1021.002 (4f9ca633-15c5-463c-9724-bdcd54fde541) Attack Pattern 2