Getting SMB brute force logs

FarhanKoujalgi — Wed, 15 Sep 2021 10:53:41 GMT

hey, guys hope you are doing well One of my customer getting the logs of SMB: User Password Brute Force Attempt for a particular user as the user is connected to Global VPN to LAN the port 445 getting reset both traffic logs in threat logs all things are working fine GP is authenticated but why these logs are getting what things we should do customer check the system side also.

Re: Getting SMB brute force logs

OtakarKlier — Tue, 21 Sep 2021 16:52:37 GMT

Hello,

Check the traffic and see if its legit. Could be a false positive as some applications look like this and it turns out to be a false positive.

Regards,

topic Re: Getting SMB brute force logs in Advanced Threat Prevention Discussions

Getting SMB brute force logs

Re: Getting SMB brute force logs