I have a situation where I see a bunch of SMB connections initiated from a client to a server every night and it triggers an SMB brute-force alert on my Firewall.
I installed Sysmon on the server to monitor what initiates the connection, but the PID is 4 which is the System process in Windows.
I'm looking for a way to monitor what has initiated this SMB connection. Maybe it's a logon script? Or some different job?
How can I identify which process / job requested this SMB connection?
Edit: To clarify, the event id is 3 for network connection and on this event id the initiating PID is 4