Protocol Analysis: SMB (Server Message Block) & Lateral Movement

Note

Executive Summary: Server Message Block (SMB) is the native Windows network protocol used for file sharing, printer access, and Inter-Process Communication (IPC). Operating over TCP port 445, it is the absolute backbone of enterprise networks. However, because it seamlessly facilitates remote execution and data transfer, it is also the primary vehicle for Lateral Movement and worm propagation (e.g., WannaCry, NotPetya). For DFIR analysts, monitoring SMB telemetry is mandatory for detecting PsExec activity, Cobalt Strike Named Pipes, and modern Remote Ransomware deployments.

1. Technical Mechanics and Administrative Shares

SMB operates on a client-server architecture. Authentication is typically handled via Kerberos in an Active Directory domain, falling back to NTLM if SPN resolution fails or if accessing via IP address.

To facilitate remote IT management, Windows automatically creates hidden Administrative Shares on every machine. These shares are appended with a $ character, rendering them invisible to standard network browsing.

• Drive Shares (C$, D$): Grants full administrative access to the root of the respective hard drive volumes.
• The ADMIN$ Share: A specific pointer to the C:\Windows directory.

Danger

The Attacker Prerequisite: Accessing these administrative shares requires local administrator privileges on the target machine. This is exactly why threat actors prioritize credential dumping and Pass-the-Hash (PtH) attacks—obtaining privileged credentials unlocks the ADMIN$ share, enabling frictionless lateral movement.

2. Adversarial Abuse of SMB (TTPs)

Threat actors weaponize SMB across multiple phases of the kill chain.

A. Execution via PsExec

As detailed in our PsExec Lateral Movement Analysis, attackers authenticate to the target’s ADMIN$ share over SMB (TCP 445), drop a malicious service executable (PSEXESVC.exe), and use RPC over SMB to instruct the Service Control Manager to execute it.

B. C2 Beacons and Named Pipes

To evade network detection, modern C2 frameworks (like Cobalt Strike or Sliver) deploy SMB Beacons. Instead of communicating directly with the internet, infected internal hosts communicate with each other over SMB using Named Pipes (accessed via the IPC$ share). To a firewall, this simply looks like legitimate internal file-sharing traffic.

C. Remote Ransomware Encryption

In modern Ransomware Investigations, adversaries often do not deploy the encryptor payload to every endpoint. Instead, they execute the ransomware on a single powerful server and encrypt thousands of files across the network entirely over SMB. This “Remote Encryption” bypasses local EDR agents on the victim workstations because the local files are merely being modified via standard network share access.

3. Forensic Triage & Telemetry

DFIR analysts rely on specific Windows Event Logs to track malicious SMB activity.

Share Access (Events 5140 & 5145)

Logged in the Security log. Event 5140: A network share object was accessed. Reveals the Source IP. Event 5145: Detailed access. If the attacker accesses the IPC$ share, the Relative Target Name will reveal the exact Named Pipe being used.

Sysmon Pipe Activity (Events 17 & 18)

Sysmon Event 17 (Pipe Created) and 18 (Pipe Connected) correlate the network SMB activity directly back to the malicious process PID hosting the beacon.

Detecting Remote Encryption (Events 30803 & 30807)

When an attacker performs aggressive remote encryption over SMB, the script opens thousands of file handles simultaneously. This aggressive, unnatural traffic often causes the SMB client connection to fail or drop. Analysts must monitor the Microsoft-Windows-SMBClient/Connectivity log. A massive spike in Event 30803 (Network connection failed) and Event 30807 (Connection disconnected) is a highly reliable behavioral signature of remote ransomware encryption in progress.

4. Threat Hunting Queries

KQL (Admin Share Abuse)

hunt_admin_share_access.kql

// Detects unauthorized access to hidden administrative shares (C$, ADMIN$)
// which is indicative of lateral movement or remote payload staging.
DeviceEvents
| where ActionType == "ShareAccessed"
| extend ShareName = tostring(AdditionalFields.ShareName)
// Target hidden administrative shares
| where ShareName endswith "C$" or ShareName endswith "ADMIN$"
// Filter out expected backup or management servers
| where RemoteIP !in ("10.0.0.50", "10.0.0.51")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, RemoteIP, ShareName
| sort by TimeGenerated desc

Splunk (Remote Ransomware)

hunt_remote_smb_encryption.spl

# Detects massive spikes in SMB disconnects, strongly indicating
# remote ransomware encryption overwhelming the SMB client limits.
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-SMBClient/Connectivity" EventCode IN (30803, 30807)
| bucket _time span=1m
| stats count by host
# Threshold: More than 100 connection drops in 1 minute
| where count > 100
| sort - count

5. Mitigation and Hardening

1. Micro-Segmentation: Workstations generally have no business communicating with other workstations over TCP 445. Enforce host-based firewalls to block workstation-to-workstation SMB traffic, limiting SMB access strictly to Domain Controllers and designated file servers. This single rule stops 90% of automated worm propagation.
2. Disable SMBv1: Ensure the deprecated and highly vulnerable SMBv1 protocol is entirely disabled across the network to prevent EternalBlue-style exploits.
3. SMB Signing: Enforce SMB Signing via Group Policy to prevent NTLM relay attacks, ensuring that intercepted SMB traffic cannot be manipulated or relayed to other servers.

---

References & Further Reading

• Microsoft Security: Secure SMB Traffic in Windows
• MITRE ATT&CK: Remote Services: SMB/Windows Admin Shares (T1021.002)
• Related Artifact: Named Pipes & Inter-Process Communication
• Related Artifact: PsExec & Lateral Movement
• Related Playbook: Ransomware Investigation