Hayabusa medium test sigma

Potential CVE-2023-23397 Exploitation Attempt - SMB

Detects (failed) outbound connection attempts to internet facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397.

View Source

Detection Logic

{
  "smbclient_connectivity": {
    "Channel": "Microsoft-Windows-SmbClient/Connectivity"
  },
  "selection": {
    "EventID": [
      30803,
      30804,
      30806
    ]
  },
  "filter_main_local_ips": [
    {
      "ServerAddress
| cidr": [
        "10.0.0.0/8",
        "127.0.0.0/8",
        "169.254.0.0/16",
        "172.16.0.0/12",
        "192.168.0.0/16",
        "::1/128",
        "fe80::/10",
        "fc00::/7"
      ]
    },
    {
      "Address
| startswith": [
        "10.",
        "127.",
        "169.254.",
        "172.",
        "192.168.",
        "::1",
        "fe80::",
        "fc00::"
      ]
    },
    {
      "Address
| contains": [
        "00000000000000000000000000000001",
        "FE80000000000000",
        "FC00000000000000",
        "0200????C0A8",
        "0200????AC",
        "0200????0A",
        "0200????7F",
        "0200????A9FE"
      ]
    },
    {
      "ServerAddress
| contains": [
        "00000000000000000000000000000001",
        "FE80000000000000",
        "FC00000000000000",
        "0200????C0A8",
        "0200????AC",
        "0200????0A",
        "0200????7F",
        "0200????A9FE"
      ]
    },
    {
      "RemoteAddress
| contains": [
        "00000000000000000000000000000001",
        "FE80000000000000",
        "FC00000000000000",
        "0200????C0A8",
        "0200????AC",
        "0200????0A",
        "0200????7F",
        "0200????A9FE"
      ]
    }
  ],
  "condition": "smbclient_connectivity and (selection and not 1 of filter_main_*)"
}

False Positives

⚠ Some false positives may occur from external trusted servers. Apply additional filters accordingly

Field Validations

Loading…

Comments (0)

Loading comments...