Detection: SMB Traffic Spike

EXPERIMENTAL DETECTION

This detection status is set to experimental. The Splunk Threat Research team has not yet fully tested, simulated, or built comprehensive datasets for this detection. As such, this analytic is not officially supported. If you have any questions or concerns, please reach out to us at research@splunk.com.

Updated Date: 2024-10-17 ID: 7f5fb3e1-4209-4914-90db-0ec21b936378 Author: David Dorsey, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic detects spikes in Server Message Block (SMB) traffic connections, which are used for sharing files and resources between computers. It leverages network traffic logs to monitor connections on ports 139 and 445, and SMB application usage. By calculating the average and standard deviation of SMB connections over the past 70 minutes, it identifies sources exceeding two standard deviations from the average. This activity is significant as it may indicate potential SMB-based attacks, such as ransomware or data theft. If confirmed malicious, attackers could exfiltrate data or spread malware within the network.

1
2| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=1h, All_Traffic.src 
3| `drop_dm_object_name("All_Traffic")` 
4| eventstats max(_time) as maxtime 
5| stats count as num_data_samples max(eval(if(_time >= relative_time(maxtime, "-70m@m"), count, null))) as count avg(eval(if(_time<relative_time(maxtime, "-70m@m"), count, null))) as avg stdev(eval(if(_time<relative_time(maxtime, "-70m@m"), count, null))) as stdev by src 
6| eval upperBound=(avg+stdev*2), isOutlier=if(count > upperBound AND num_data_samples >=50, 1, 0) 
7| where isOutlier=1 
8| table src count 
9| `smb_traffic_spike_filter`

Data Source

No data sources specified for this detection.

Macros Used

Name Value
security_content_summariesonly summariesonly=summariesonly_config allow_old_summaries=oldsummaries_config fillnull_value=fillnull_config``
smb_traffic_spike_filter search *
smb_traffic_spike_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1021.002 SMB/Windows Admin Shares Lateral Movement
T1021 Remote Services Lateral Movement
KillChainPhase.EXPLOITAITON
NistCategory.DE_AE
Cis18Value.CIS_13
APT28
APT3
APT32
APT39
APT41
Aquatic Panda
Blue Mockingbird
Chimera
Cinnamon Tempest
Deep Panda
FIN13
FIN8
Fox Kitten
Ke3chang
Lazarus Group
Moses Staff
Orangeworm
Play
Sandworm Team
Threat Group-1314
ToddyCat
Turla
Wizard Spider
Aquatic Panda
Ember Bear
Wizard Spider

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Risk Event True
This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.

Implementation

This search requires you to be ingesting your network traffic logs and populating the Network_Traffic data model.

Known False Positives

A file server may experience high-demand loads that could cause this analytic to trigger.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message Risk Score Impact Confidence
Anomalous splike of SMB traffic sent from $src$ 25 50 50
The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation Not Applicable N/A N/A N/A
Unit ❌ Failing N/A N/A N/A
Integration ❌ Failing N/A N/A N/A

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 5