Paneliya Mehulkumar 0 Posted September 7, 2022 Posted September 7, 2022 (edited) Again SMB.Attack.Bruteforce started in many systems What is the permanent solution for this issue? No one is giving us permanent solution steps in many systems even after windows up to date SMB.Attack.Bruteforce events repeated. Please find attached excel file for the same smb15.zip Edited September 7, 2022 by Paneliya Mehulkumar
Administrators Marcos 5,441 Posted September 7, 2022 Administrators Posted September 7, 2022 You can create your own rules with increased number of invalid SMB login attempts here if you accept it in your network and don't mind it from the security point of view:
Most Valued Members Nightowl 206 Posted September 7, 2022 Most Valued Members Posted September 7, 2022 2 hours ago, Paneliya Mehulkumar said: Again SMB.Attack.Bruteforce started in many systems What is the permanent solution for this issue? No one is giving us permanent solution steps in many systems even after windows up to date SMB.Attack.Bruteforce events repeated. Please find attached excel file for the same smb15.zipUnavailable If it's coming from LAN then it indicates that this PC is infected and trying to pass If it's coming from WAN then it indicates that this PC is under attack from internet and the firewall that protects it isn't working properly (hardware firewall) If you have to accept SMB from outside , it's better to whitelist for specific IPs to access and rest to be blocked.
Recommended Posts