SMB.Attack.Bruteforce

[Paneliya Mehulkumar 0]

Again  SMB.Attack.Bruteforce started in many systems 

 

What is the permanent  solution for this issue?

No one is  giving us permanent solution steps in many systems even after windows up to date  SMB.Attack.Bruteforce events repeated.

Please find attached excel file for the same

 

smb15.zip

Edited September 7, 2022 by Paneliya Mehulkumar

[Marcos 5,074]

You can create your own rules with increased number of invalid SMB login attempts here if you accept it in your network and don't mind it from the security point of view:

 

 

[Nightowl 202]

2 hours ago, Paneliya Mehulkumar said:

Again  SMB.Attack.Bruteforce started in many systems 

 

What is the permanent  solution for this issue?

No one is  giving us permanent solution steps in many systems even after windows up to date  SMB.Attack.Bruteforce events repeated.

Please find attached excel file for the same

 

smb15.zipUnavailable

If it's coming from LAN then it indicates that this PC is infected and trying to pass

If it's coming from WAN then it indicates that this PC is under attack from internet and the firewall that protects it isn't working properly (hardware firewall)

If you have to accept SMB from outside , it's better to whitelist for specific IPs to access and rest to be blocked.