title: Outbound SMB To A Public Address
id: 1ec97802-2511-40a1-bdf9-06116913caac
status: experimental
description: |
  Detects an allowed connection on TCP 445 from inside the network to an address outside the
  private ranges. There is almost no legitimate reason for SMB to cross the perimeter, and the
  malicious reasons include forced authentication (a lure that makes the host send its NetNTLM
  hash to the operator) and exfiltration.
references:
  - https://attack.mitre.org/techniques/T1187/
  - https://attack.mitre.org/techniques/T1048/
author: Security Artifacts
date: 2026-09-21
tags:
  - attack.credential-access
  - attack.t1187
  - attack.exfiltration
  - attack.t1048
logsource:
  category: firewall
detection:
  selection:
    dst_port: 445
    action:
      - 'allow'
      - 'accept'
      - 'permit'
  filter_main_private:
    dst_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.0/8'
      - '169.254.0.0/16'
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Azure Files and similar cloud file shares mounted over SMB 3. If you use one, exclude its published address ranges and keep the rule.
level: high