NF - Policy - SMB2 connection containing CISF fileshare information - Check for external IP

NF – Policy – SMB2 connection containing CISF fileshare information – Check for external IP

The rule detects an SMB2 connection containing CISF fileshare information. The rule suggests checking for an external IP address involved in the communication.

Categories:

Cyber Attack
Radiflow

ID Number

5026014

Signature

alert tcp any any -> any any (msg:"NF - Policy - SMB2 connection containing CISF fileshare information - Check for external IP"; flow:established; content:"|fe 53 4d 42|"; content:"|63 00 69 00 66 00 73 00 2f 00|"; reference:url,networkforensic.dk; metadata:21092018; classtype:misc-activity; sid:5026014; rev:1;)

MITRE ATT&CK Technique

Severity

Medium

Recommendations/Investigative actions

Authorize the connection. If the connection was approved - archive and baseline the rule. If not - check the connection and investigate the file and the relevant IP address.