SMB NTLM Negotiation To Unknown Remote I Ps
Query
DeviceNetworkEvents
| extend af = parse_json(AdditionalFields)
| extend SignatureName = tostring(af.SignatureName)
| extend SigMatched = tostring(af.SignatureMatchedContent)
| extend SamplePacket = tostring(af.SamplePacketContent)
| where isnotempty(RemoteIP)
and (RemotePort in (139, 445) or LocalPort in(139,445) or SigMatched contains "%FESMB" or SigMatched contains "%FFSMB" or SigMatched contains "NTLMSSP" or SamplePacket contains "NTLMSSP")
| where not(ipv4_is_private(RemoteIP)) and isnotempty(SignatureName) // only public IPv4
| extend geo_ip = tostring(geo_info_from_ip_address(RemoteIP).country)
| where isnotempty(geo_ip)
| extend Combined = strcat(SigMatched, " ", SamplePacket)
| extend MsgTypeNum = case(
Combined contains "%01%00%00%00" or Combined contains "\x01\x00\x00\x00", 1,
Combined contains "%02%00%00%00" or Combined contains "\x02\x00\x00\x00", 2,
Combined contains "%03%00%00%00" or Combined contains "\x03\x00\x00\x00", 3,
0)
| extend MsgType = case(
MsgTypeNum == 1, "Type 1 = client initiates (Negotiate)",
MsgTypeNum == 2, "Type 2 = server responds with Challenge",
MsgTypeNum == 3, "Type 3 = client sends response with credentials",
"Unknown / not extracted")
| summarize make_set(RemotePort),Distinct_ports=dcount(RemotePort), count() by DeviceName,LocalPort, InitiatingProcessFileName,geo_ip,RemoteIP, SignatureName,MsgType, ActionType
| order by Distinct_portsAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1021.002 | Remote Services: SMB/Windows Admin Shares |
| T1557.001 | Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay |
Author: Sergio Albea (22/09/2025)
SMB & NTLM Negotiation to Unknown Remote IPs
Description: NetworkSignatureInspected just means the network sensor saw and matched a signature (it inspected the packet) — it doesn’t mean the flow was blocked. That’s the problem. If your machines are negotiating SMB or NTLM with unknown remote IPs, you’ve got a real risk on your hands: data leakage, credential relay, or worm-style propagation. SMB to the Internet is almost never legitimate; if you don’t recognize the remote IP, treat it as suspicious.
The KQL query includes multiple conditions to detect not only default connections on legacy (139) or modern (445) SMB ports, but also cases where SMB is running over non-standard ports (attempts to evade simple port-based detection). It also extracts the SMB negotiation state so you can spot repeated or incomplete negotiation attempts (useful to detect scanning, failed auths, or relay attempts).
Explanation
This KQL query is designed to detect potentially suspicious network activity involving SMB (Server Message Block) and NTLM (NT LAN Manager) protocols. Here's a simplified breakdown of what the query does:
-
Data Source: It analyzes network events from a dataset called
DeviceNetworkEvents. -
Signature Inspection: The query checks if network packets match certain signatures related to SMB and NTLM protocols. This inspection helps identify specific types of network traffic.
-
Port and Signature Filtering: It looks for connections on standard SMB ports (139 and 445) and also checks for SMB traffic on non-standard ports, which might indicate attempts to bypass simple port-based security measures.
-
Public IP Filtering: The query focuses on connections to public IP addresses, excluding private IPs, as connections to unknown public IPs are more likely to be suspicious.
-
Geolocation: It extracts the country information of the remote IPs to provide geographical context.
-
Message Type Identification: The query identifies the type of SMB/NTLM negotiation messages (e.g., client initiation, server challenge, client response) to detect patterns like repeated or incomplete negotiation attempts, which could indicate scanning or unauthorized access attempts.
-
Summarization: Finally, it summarizes the data by various attributes such as device name, local port, initiating process, remote IP, and message type, and counts the occurrences. This helps in identifying patterns and potential threats.
-
Ordering: The results are ordered by the number of distinct ports used, which can help prioritize the analysis of devices with more varied network activity.
Overall, this query is used to identify and analyze potentially risky SMB/NTLM traffic to unknown remote IPs, which could indicate data leakage, credential theft, or malicious propagation attempts.
Details
Sergio Albea
Released: September 22, 2025
Tables
Keywords
Operators