Paneliya Mehulkumar 0 Posted September 7, 2022 Share Posted September 7, 2022 (edited) Again SMB.Attack.Bruteforce started in many systems What is the permanent solution for this issue? No one is giving us permanent solution steps in many systems even after windows up to date SMB.Attack.Bruteforce events repeated. Please find attached excel file for the same smb15.zip Edited September 7, 2022 by Paneliya Mehulkumar Link to comment Share on other sites More sharing options...
Administrators Marcos 5,235 Posted September 7, 2022 Administrators Share Posted September 7, 2022 You can create your own rules with increased number of invalid SMB login attempts here if you accept it in your network and don't mind it from the security point of view: Link to comment Share on other sites More sharing options...
Most Valued Members Nightowl 206 Posted September 7, 2022 Most Valued Members Share Posted September 7, 2022 2 hours ago, Paneliya Mehulkumar said: Again SMB.Attack.Bruteforce started in many systems What is the permanent solution for this issue? No one is giving us permanent solution steps in many systems even after windows up to date SMB.Attack.Bruteforce events repeated. Please find attached excel file for the same smb15.zipUnavailable If it's coming from LAN then it indicates that this PC is infected and trying to pass If it's coming from WAN then it indicates that this PC is under attack from internet and the firewall that protects it isn't working properly (hardware firewall) If you have to accept SMB from outside , it's better to whitelist for specific IPs to access and rest to be blocked. Link to comment Share on other sites More sharing options...
Recommended Posts