CVE-2020-0796

Sentinel/Defender KQL

let smb_port = 445;
NetworkCommunicationEvents
| where RemotePort == smb_port or LocalPort == smb_port
| where InitiatingProcessName has_any ("smb", "svchost", "System") // Oder andere relevante Prozesse
| summarize count() by bin(5m), RemoteIP, RemotePort, LocalIP, LocalPort, InitiatingProcessName
| where count_ > 100 // Beispiel: Hohe Anzahl von SMB-Verbindungen in kurzer Zeit
| project StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), RemoteIP, RemotePort, LocalIP, LocalPort, InitiatingProcessName, ConnectionCount = count_
| extend Description = 'Potentially anomalous SMB traffic related to CVE-2020-0796'

Splunk SPL

index=* (sourcetype=WinEventLog:Microsoft-Windows-SMBServer/Operational OR sourcetype=WinEventLog:System) EventCode=*
| where DstPort=445 OR SrcPort=445
| stats count by _time, src_ip, dest_ip, DstPort, SrcPort
| where count > 100
| rename count as ConnectionCount
| eval Description = "Potentially anomalous SMB traffic related to CVE-2020-0796"

Sigma

title: SMBv3 RCE (CVE-2020-0796) Anomaly Detection
author: SecBoard Operations
date: 2023/10/27
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 445
  timeframe: 5m
  condition: selection | count() > 100
  fields:
    - SourceIp
    - DestinationIp
    - DestinationPort
  falsepositives:
    - Legitimate high SMB traffic
level: high

Elastic ES|QL

from network_traffic
| where destination.port == 445 or source.port == 445
| where process.name : ("smb", "svchost", "System")
| summarize connection_count = count() by span(timestamp, 5m), source.ip, destination.ip, destination.port, source.port, process.name
| where connection_count > 100
| project timestamp, source.ip, destination.ip, destination.port, source.port, process.name, connection_count
| append { 'Description': 'Potentially anomalous SMB traffic related to CVE-2020-0796' }