Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

SMB Connections via LOLBin or Untrusted Process

Identifies potentially suspicious processes that are not trusted or living-off-the-land binaries (LOLBin) making Server Message Block (SMB) network connections over port 445. Windows File Sharing is typically implemented over SMB, which communicates between hosts using port 445. Legitimate connections are generally established by the kernel (PID 4). This rule helps to detect processes that might be port scanners, exploits, or user-level processes attempting lateral movement within the network by leveraging SMB connections.

ATT&CK coverage

Outside the enterprise matrix

Detection requirements

Log source category: event_index

What the source says

References

Tagged by the source as

Data Source: Elastic DefendDomain: EndpointOS: WindowsResources: Investigation GuideTactic: Lateral MovementUse Case: Threat Detection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.