Sagan unknown stable other

[EXPERIMENTAL][WINDOWS-SECURITY] SMB - Anonymous Access Denied to ADMIN$ Share

[EXPERIMENTAL][WINDOWS-SECURITY] SMB - Anonymous Access Denied to ADMIN$ Share

View Source

Detection Logic

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[EXPERIMENTAL][WINDOWS-SECURITY] SMB - Anonymous Access Denied to ADMIN$ Share"; program:Microsoft-Windows-SMBServer/Security; event_id:1007; content:"ADMIN
| 24
| "; classtype:lateral-movement; parse_src_ip:1; threshold:type suppress,track by_src,count 1,seconds 3600; reference:url,attack.mitre.org/techniques/T1021/; metadata:createdOn 2026_06_11, updatedOn 2026_06_16; sid:9870004; rev:2;)

Field Validations

Loading…

Comments (0)

Loading comments...