SMB: lateral movement & exploitation techniques

SMB (Server Message Block) is a network protocol used for sharing files, printers, and named pipes between Windows systems. SMB lateral movement and exploitation techniques rank among the most abused attack vectors in Active Directory environments. The protocol operates over TCP port 445 and relies on NTLM or Kerberos authentication. SMB versions range from the legacy SMBv1, infamous for enabling EternalBlue (MS17-010), to SMBv2 and SMBv3, which introduced signing and encryption capabilities. Attackers target SMB because it is almost universally enabled on Windows hosts and carries authentication material directly. Named pipes, which are a core SMB feature, allow remote procedure calls and are leveraged by tools like PsExec, Impacket's smbexec, and Cobalt Strike for remote code execution. The protocol also underpins DCE/RPC, making it central to many Windows administration tasks and, consequently, to attacker tradecraft in enterprise networks.

Detecting SMB abuse requires correlation across several log sources. Windows Security Event ID 4624 (logon type 3, network logon) combined with Event ID 4672 (special privileges assigned) indicates a privileged SMB authentication. Event ID 4648 signals explicit credential use over the network. Service creation events (ID 7045 in System log) appear when PsExec or similar tools install a remote service via SMB. Enable object access auditing to catch named pipe connections (Event ID 5145), which expose lateral movement through shares like IPC$. At the network level, monitor for SMB connections between workstations (peer-to-peer SMB traffic is abnormal in most environments). Zeek and Suricata both include SMB analyzers that extract filenames, tree paths, and authentication sequences. Sudden spikes in SMB authentication failures (Event ID 4625) may indicate credential spraying or relay activity. Sysmon Event ID 3 logs network connections, helping correlate process-to-SMB-session mappings. SIEM rules should flag any SMB traffic to domain controllers from non-administrative hosts.

Red Team operators rely on SMB for multiple attack chains. NTLM relay attacks capture authentication challenges using Responder and forward them with ntlmrelayx to authenticate against target SMB services, bypassing password knowledge entirely. SMB signing disabled on a target is a prerequisite for relay success. Pass-the-Hash attacks reuse NTLM hash material extracted via LSASS dumping (Mimikatz, CrackMapExec) to authenticate without cracking. EternalBlue (MS17-010) exploits a buffer overflow in SMBv1 to achieve unauthenticated remote code execution. Impacket's suite (psexec.py, smbexec.py, wmiexec.py) provides flexible SMB-based remote execution with varying detection profiles. For hardening, enforce SMB signing on all hosts via Group Policy (Microsoft network server: digitally sign communications always). Disable SMBv1 through PowerShell (Set-SmbServerConfiguration -EnableSMB1Protocol $false). Segment the network to block workstation-to-workstation SMB. Restrict NTLM authentication using GPO and enforce Local Administrator Password Solution (LAPS) to prevent lateral movement through shared local credentials.