name: Detect Outbound SMB Traffic
id: 7f5fb3e1-4209-414-90db-0ec21b936378
version: 3
date: '2020-07-21'
author: Bhavin Patel, Stuart Hopkins from Splunk
type: batch
datamodel:
- Network_Traffic
description: This search looks for outbound SMB connections made by hosts within your
  network to the Internet. SMB traffic is used for Windows file-sharing activity.
  One of the techniques often used by attackers involves retrieving the credential
  hash using an SMB request made to a compromised server controlled by the threat
  actor.
search: '| tstats `security_content_summariesonly` earliest(_time) as start_time latest(_time)
  as end_time values(All_Traffic.action) as action values(All_Traffic.app) as app
  values(All_Traffic.dest_ip) as dest_ip values(All_Traffic.dest_port) as dest_port
  values(sourcetype) as sourcetype count from datamodel=Network_Traffic where ((All_Traffic.dest_port=139
  OR All_Traffic.dest_port=445 OR All_Traffic.app="smb") AND NOT (All_Traffic.action="blocked"
  OR All_Traffic.dest_category="internal" OR All_Traffic.dest_ip=10.0.0.0/8 OR All_Traffic.dest_ip=172.16.0.0/12
  OR All_Traffic.dest_ip=192.168.0.0/16 OR All_Traffic.dest_ip=100.64.0.0/10)) by
  All_Traffic.src_ip | `drop_dm_object_name("All_Traffic")` | `security_content_ctime(start_time)`
  | `security_content_ctime(end_time)` | `detect_outbound_smb_traffic_filter`'
how_to_implement: 'In order to run this search effectively, we highly recommend that
  you leverage the Assets and Identity framework. It is important that you have good
  understanding of how your network segments are designed, and be able to distinguish
  internal from external address space. Add a category named `internal` to the CIDRs
  that host the companys assets in `assets_by_cidr.csv` lookup file, which is located
  in `$SPLUNK_HOME/etc/apps/SA-IdentityManagement/lookups/`. More information on updating
  this lookup can be found here: https://docs.splunk.com/Documentation/ES/5.0.0/Admin/Addassetandidentitydata.
  This search also requires you to be ingesting your network traffic and populating
  the Network_Traffic data model'
known_false_positives: It is likely that the outbound Server Message Block (SMB) traffic
  is legitimate, if the company's internal networks are not well-defined in the Assets
  and Identity Framework. Categorize the internal CIDR blocks as `internal` in the
  lookup file to avoid creating notable events for traffic destined to those CIDR
  blocks. Any other network connection that is going out to the Internet should be
  investigated and blocked. Best practices suggest preventing external communications
  of all SMB versions and related protocols at the network boundary.
references: []
tags:
  analytic_story:
  - Hidden Cobra Malware
  - DHS Report TA18-074A
  - NOBELIUM Group
  asset_type: Endpoint
  cis20:
  - CIS 12
  kill_chain_phases:
  - Actions on Objectives
  - Command and Control
  mitre_attack_id:
  - T1071.002
  nist:
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - All_Traffic.action
  - All_Traffic.app
  - All_Traffic.dest_ip
  - All_Traffic.dest_port
  - sourcetype
  - All_Traffic.dest_category
  - All_Traffic.src_ip
  security_domain: network
