topic Re: SMB: User password brute force in Advanced Threat Prevention Discussions

SMB: User password brute force

charlesk — Fri, 06 Sep 2019 20:38:46 GMT

We have been seeing SMB: User Password Brute Force Attempt threats coming into our logs. We are not seeing a UN accompanied with the the traffic and the are using port 445. This just popped up recently and we are not seeing anything malicious on the client or the DC which is being reached out to. We are trying to identify what might be causing this and are curious if anyone else is seeing this.

Re: SMB: User password brute force

upelister — Sun, 31 Jan 2021 22:58:39 GMT

Hello,

Checking server security logs can be helpful.

To investigate further enabling extended packet capture on ip profile may be helpful.

*Sometimes also i am seeing this event on logs and considering it as false positive.