SMB shares discovery

Description

Query for processes that accessed more than 10 IP addresses over port 445 (SMB) - possibly scanning for network shares. To read more about Network Share Discovery, see: https://attack.mitre.org/wiki/Technique/T1135. Tags: #SMB, #NetworkScanning, #UniqueProcessId.

Query · kql

DeviceNetworkEvents
| where RemotePort == 445 and Timestamp > ago(7d) 
    // Exclude Kernel processes, as they are too noisy in this query
    and InitiatingProcessId !in (0, 4)
| summarize RemoteIPCount=dcount(RemoteIP) by DeviceName, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCreationTime
| where RemoteIPCount > 10
Raw source SMB shares discovery · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: a3dc6ecb-d910-467b-844e-a3b87744c4c9
name: SMB shares discovery
description: |
  Query for processes that accessed more than 10 IP addresses over port 445 (SMB) - possibly scanning for network shares.
  To read more about Network Share Discovery, see: https://attack.mitre.org/wiki/Technique/T1135.
  Tags: #SMB, #NetworkScanning, #UniqueProcessId.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceNetworkEvents
query: |
  DeviceNetworkEvents
  | where RemotePort == 445 and Timestamp > ago(7d) 
      // Exclude Kernel processes, as they are too noisy in this query
      and InitiatingProcessId !in (0, 4)
  | summarize RemoteIPCount=dcount(RemoteIP) by DeviceName, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCreationTime
  | where RemoteIPCount > 10

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.