Hunt for devices with the most SMB connections
Devices With Most SMB Connections
Query
DeviceNetworkEvents
| where RemotePort == 445
| where ActionType == "ConnectionSuccess"
// Collect the last event that a device has connected via SMB to a unique remote IP
| summarize arg_max(Timestamp, *) by DeviceId, RemoteIP
| summarize RemoteSMBUrls = make_set_if(RemoteUrl, isnotempty(RemoteUrl)), make_set_if(RemoteIP, isempty(RemoteUrl)), TotalConnections = dcount(RemoteIP) by DeviceName
| sort by TotalConnectionsAbout this query
Hunt for devices with the most SMB connections
Query Information
Description
This hunting query lists all the devices and the unique connections they have made with a remote SMB port. Devices with a large number of connected SMB sessions can be interesting to investigate.
Defender XDR
Sentinel
DeviceNetworkEvents
| where RemotePort == 445
| where ActionType == "ConnectionSuccess"
// Collect the last event that a device has connected via SMB to a unique remote IP
| summarize arg_max(TimeGenerated, *) by DeviceId, RemoteIP
| summarize RemoteSMBUrls = make_set_if(RemoteUrl, isnotempty(RemoteUrl)), make_set_if(RemoteIP, isempty(RemoteUrl)), TotalConnections = dcount(RemoteIP) by DeviceName
| sort by TotalConnections
Explanation
This query is designed to identify devices that have established the most connections using the Server Message Block (SMB) protocol, specifically on port 445. Here's a simplified breakdown of what the query does:
-
Filter Events: It starts by filtering network events to only include those where the remote port is 445, which is commonly used for SMB connections, and where the connection was successful.
-
Identify Unique Connections: For each device, it identifies the most recent event of a successful SMB connection to each unique remote IP address.
-
Summarize Data: It then summarizes the data by device name, creating a list of unique remote URLs and IPs that each device has connected to via SMB. It also counts the total number of unique remote IPs each device has connected to.
-
Sort Results: Finally, it sorts the devices by the total number of unique SMB connections, allowing you to easily identify which devices have the most SMB connections.
This query is useful for hunting and investigating devices that might be engaging in unusual or excessive SMB activity, which could be indicative of security issues or misconfigurations.
Details
Bert-Jan Pals
Released: December 1, 2024
Tables
Keywords
Operators