1

I have a situation where I see a bunch of SMB connections initiated from a client to a server every night and it triggers an SMB brute-force alert on my Firewall.

I installed Sysmon on the server to monitor what initiates the connection, but the PID is 4 which is the System process in Windows.

I'm looking for a way to monitor what has initiated this SMB connection. Maybe it's a logon script? Or some different job?

How can I identify which process / job requested this SMB connection?

Edit: To clarify, the event id is 3 for network connection and on this event id the initiating PID is 4

2 Answers 2

1

With information such as the destination address, identifying an object handle to \Device\Mup and trace back to a process would help in this situation. This can be done with Handle or Volatility handles command in case there is a memory dump file.

explorer.exe pid: 2904 UNNAMED\Administrator
   10: File  (RW-)   C:\Windows\System32
   8C: File  (R-D)   C:\Windows\en-US\explorer.exe.mui
  17C: Section       \Windows\Theme1983439688
 .......
 16F0: File  (RWD)   \Device\Mup\192.168.1.2\C$
 1754: File  (R-D)   C:\Windows\System32\en-US\hcproviders.dll.mui
0

Ideally if trying to figure out what's making the connection there would be some monitoring (eg. procmon / packet capture on the client side. The server PID will always be the same since that's the server process and it's not initiating the connection, simply serving a response.

If it's not possible to monitor the client and the monitoring must be done on the server then there are a few methods that could be employed:

  • Network packet capture, which would show what kind of SMB traffic was hitting which ports
  • File system auditing, which would show if there were files being accessed at the same time
  • Process monitoring, which will show everything the system is doing - very verbose

Since it's the firewall triggering the alert it's likely network traffic, so a packet capture would be a good place to start. That might lead you to do something else in terms of monitoring.

Note also that a personal firewall / IDS might also help. If that's what is meant by "firewall" above then see if there are some verbose logs in there to tell what's going on.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.