Sigma rule: Unsigned or Unencrypted SMB Connection to Share Established

Rule

Title

Unsigned or Unencrypted SMB Connection to Share Established

Status

experimental

Level

medium

Author

Mohamed Abdelghani

Date

2025-10-19

File

rules/windows/builtin/smbserver/connectivity/win_smbserver_connectivity_unsigned_and_unencrypted_share_connection.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects SMB server connections to shares without signing or encryption enabled.
This could indicate potential lateral movement activity using unsecured SMB shares.

Log source

product

windows

service

smbserver-connectivity

Detection

selection_shares:
    EventID: 4000
    ShareName|contains:
        - 'IPC$'
        - 'ADMIN$'
        - 'C$'
selection_status:
    - SigningUsed: 'false'
    - EncyptionUsed: 'false' # Note: typo in the original event field name
filter_main_local_ips:
    - ClientAddress|cidr:
          # IPv4
          # - '10.0.0.0/8'
          - '127.0.0.0/8'
          - '169.254.0.0/16'
          # - '172.16.0.0/12'
          # - '192.168.0.0/16'
          # IPv6
          - '::1/128'  # IPv6 loopback
          - 'fe80::/10'  # IPv6 link-local addresses
          - 'fc00::/7'  # IPv6 private addresses
    # The filters below cover the XML raw log
    - ClientAddress|contains:
          # IPv6
          - '00000000000000000000000000000001' # ::1 - IPv6 loopback
          - 'FE80000000000000' # fe80:: - IPv6 link-local addresses
          - 'FC00000000000000' # fc00:: - IPv6 private addresses
          # IPv4
          # The "?" are meant to represent the port
          # - '0200????C0A8' # 192.168.
          # - '0200????AC' # 172.
          # - '0200????0A' # 10.
          - '0200????7F' # 127
          - '0200????A9FE' # 169.254.
condition: all of selection_* and not 1 of filter_main_*

False positives (as the rule lists them)

• Connections from local or private IP addresses to SMB shares without signing or encryption enabled for older systems or misconfigured environments. Apply additional tuning as needed.

Tags

• attack.lateral-movement
• attack.t1021.002

MITRE ATT&CK ids this rule names

• T1021.002

References

• https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/overview-server-message-block-signing

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/smbserver/connectivity/win_smbserver_connectivity_unsigned_and_unencrypted_share_connection.yml