New KSMBD Do S CVE 2025 38501 Can Exhaust SMB Connections Via Half Open TCP Handshakes
Query
DeviceInfo
| where OSPlatform has "Linux"
| join kind=inner ( DeviceNetworkEvents) on $left.DeviceId == $right.DeviceId
| where RemotePort == 445
| extend Geo_ip = tostring(geo_info_from_ip_address(RemoteIP).country)
| summarize Connection_Attempts=count() by RemoteIP,Geo_ip,RemotePort, DeviceId, DeviceName
| order by Connection_AttemptsAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1499 | Endpoint Denial of Service |
Author: Sergio Albea (17/09/2025)
New KSMBD DoS (CVE-2025-38501) can exhaust SMB connections via half-open TCP handshakes
Description: New KSMBD DoS (CVE-2025-38501) can exhaust SMB connections via half-open TCP handshakes — patch to Linux 6.1.15+ or rate-limit TCP/445 to mitigate. This KQL query helps to hunt for connection attempts to port 445 across Linux endpoints in Defender XDR.
Explanation
This KQL query is designed to help security analysts identify potential denial-of-service (DoS) attacks targeting Linux systems by monitoring connection attempts to port 445, which is commonly used for SMB (Server Message Block) services. The query specifically looks for attempts that could exploit a vulnerability (CVE-2025-38501) related to half-open TCP handshakes, which can exhaust SMB connections.
Here's a simplified breakdown of what the query does:
-
Filter for Linux Devices: It starts by selecting devices running the Linux operating system.
-
Join Network Events: It combines information from device network events with the device information to correlate network activity with specific devices.
-
Focus on Port 445: It filters the network events to only include those targeting port 445, which is associated with SMB services.
-
Geolocation Information: It adds geolocation data to identify the country associated with the remote IP address attempting the connection.
-
Count Connection Attempts: It counts how many times each remote IP address attempts to connect to port 445 on each device.
-
Order by Attempts: Finally, it orders the results by the number of connection attempts, helping analysts quickly identify which IP addresses are making the most attempts and may be suspicious.
This query is useful for detecting potential DoS attacks on Linux systems by identifying unusual or excessive connection attempts to the SMB service port.
