Query Details
New KSMBD Do S CVE 2025 38501 Can Exhaust SMB Connections Via Half Open TCP Handshakes
Query
**New KSMBD DoS (CVE-2025-38501) can exhaust SMB connections via half-open TCP handshakes** **Description:** New KSMBD DoS (CVE-2025-38501) can exhaust SMB connections via half-open TCP handshakes — patch to Linux 6.1.15+ or rate-limit TCP/445 to mitigate. This KQL query helps to hunt for connection attempts to port 445 across Linux endpoints in Defender XDR. ``` DeviceInfo | where OSPlatform has "Linux" | join kind=inner ( DeviceNetworkEvents) on $left.DeviceId == $right.DeviceId | where RemotePort == 445 | extend Geo_ip = tostring(geo_info_from_ip_address(RemoteIP).country) | summarize Connection_Attempts=count() by RemoteIP,Geo_ip,RemotePort, DeviceId, DeviceName | order by Connection_Attempts ```
Explanation
This KQL query is designed to help identify potential exploitation attempts of a new vulnerability (CVE-2025-38501) that affects Linux systems. The vulnerability allows attackers to exhaust SMB connections by using half-open TCP handshakes on port 445. Here's a simple breakdown of what the query does:
-
Filter for Linux Devices: It starts by selecting information from devices that are running a Linux operating system.
-
Join Network Events: It combines this device information with network event data, matching records based on a common device identifier.
-
Focus on Port 445: The query specifically looks for network events where the remote port is 445, which is commonly used for SMB (Server Message Block) connections.
-
Geolocation Information: It adds geolocation information to the results, identifying the country associated with the remote IP address involved in the connection attempt.
-
Summarize Connection Attempts: It counts the number of connection attempts to port 445 for each unique combination of remote IP, geolocation, port, device ID, and device name.
-
Order Results: Finally, it orders the results by the number of connection attempts, allowing analysts to easily identify which IPs are making the most connection attempts.
This query is useful for security analysts using Microsoft Defender XDR to monitor and investigate suspicious network activity related to this specific vulnerability on Linux endpoints.
Details
Sergio Albea
Released: September 17, 2025
Tables
Keywords
Operators