Detect one source probing SMB across multiple devices

I used the DeviceNetworkEvents table in Microsoft Defender XDR to alert on anomalous SMB enumeration: one unusual source IP probing SMB ports on multiple different devices in a short period. The rule considers the spread of activity across devices and time, connecting individual network events to a reconnaissance pattern.

MITRE ATT&CK Detection use-case development Attack-path analysis Telemetry requirements Security risk prioritisation KQL Microsoft Defender XDR SQL Server security SMB enumeration detection Credential exposure hunting Threat hunting Active Directory NTLM authentication

Return to the full story ←

Detect one source probing SMB across multiple devices

Viewed history

Ask about my work.