Devices with the most SMB connections

Devices With The Most SMB Sessions

Query

let TimeFrame = 24h; //Customizable h = hours, d = days
let AllDomainControllers =
     DeviceNetworkEvents
     | where LocalPort == 88
     | where LocalIPType == "FourToSixMapping"
     | summarize make_set(DeviceId);
DeviceNetworkEvents
| where Timestamp > ago(TimeFrame)
| where RemotePort == 445
| where not(DeviceId in (AllDomainControllers)) // THis is to reduce FP because of e.g. MDI, if you do not have MDI do not use this filter.
| summarize TotalRemoteConnections = dcount(RemoteIP) by DeviceName
| sort by TotalRemoteConnections

About this query

Devices with the most SMB connections

Query Information

Description

List all devices with the amount of SMB sessions they have.

Defender XDR

Sentinel

let TimeFrame = 24h; //Customizable h = hours, d = days
let AllDomainControllers =
     DeviceNetworkEvents
     | where LocalPort == 88
     | where LocalIPType == "FourToSixMapping"
     | summarize make_set(DeviceId);
DeviceNetworkEvents
| where TimeGenerated > ago(TimeFrame)
| where RemotePort == 445
| where not(DeviceId in (AllDomainControllers)) // This is to reduce FP because of e.g. MDI, if you do not have MDI do not use this filter.
| summarize TotalRemoteConnections = dcount(RemoteIP) by DeviceName
| sort by TotalRemoteConnections

Explanation

This query is designed to identify devices with the most Server Message Block (SMB) connections over a specified time period, which is set to 24 hours by default but can be adjusted. Here's a simple breakdown of what the query does:

Define Time Frame: The query sets a time frame of 24 hours to look back from the current time.
Identify Domain Controllers: It first identifies all domain controllers by looking for network events where the local port is 88 (commonly used for Kerberos authentication) and the IP type indicates a specific mapping. These domain controllers are collected into a set to be excluded later.
Filter Network Events: The query then filters network events to find those where the remote port is 445, which is typically used for SMB connections.
Exclude Domain Controllers: It excludes any events from devices identified as domain controllers to avoid false positives, especially if Microsoft Defender for Identity (MDI) is in use.
Count Unique Connections: For each device, it counts the number of unique remote IP addresses it has connected to over SMB.
Sort Devices: Finally, it sorts the devices by the total number of unique SMB connections, allowing you to see which devices have the most SMB activity.

This query is useful for monitoring and analyzing SMB traffic, potentially identifying unusual or excessive SMB connections that might indicate security issues or network misconfigurations.

Details

Bert-Jan Pals

Released: December 1, 2024

Tables

DeviceNetworkEvents

Keywords

Devices

Operators

let//|where==summarizemake_setinnot>agodcountbysort

Actions

GitHub

KQL Search