Threat Hunting Exercise: Analyzing IDS/Snort EternalBlue SMB Exploit Lateral Movement Dataset
This hunt uses simulated network IDS data (ids_snort_eternalblue_2022-04-16T090000.json) capturing T1210: Exploitation of Remote Services and T1021.002: SMB/Windows Admin Shares, where an adversary who has landed on one workstation uses an EternalBlue-style SMBv1 exploit to pivot to adjacent hosts on the same subnet.
Step 1: Hypothesis Formation
Hypothesis: Following initial compromise of one host, the adversary scans the local /24 for open TCP/445, then sends crafted SMBv1 Trans2 SECONDARY packets matching known MS17-010 exploit signatures to multiple destination hosts in rapid succession, with successful targets showing a new SYSTEM-level process spawn shortly after. Indicators:
- IDS alerts:
ET EXPLOIT Possible ETERNALBLUE MS17-010 Echo Response/SMB1 Trans2 Secondarysignature hits, multiple destination IPs, single source IP, tight time window. - Preceding TCP/445 SYN sweep from the same source across the subnet (reconnaissance phase).
- Correlated host telemetry: new SYSTEM process (e.g., spoolsv.exe spawning cmd.exe) on hosts that received the exploit signature hit.
- No legitimate vulnerability scanner (per asset inventory) is scheduled to run against this subnet at this time.
Null Hypothesis: An authorized vulnerability scanner (e.g., Nessus/Qualys) triggered the IDS signatures during a routine scan. Invalidate via change-calendar cross-check for scheduled scans and by confirming the scanner's known source IP does not match.
Rationale: MS17-010-class exploits remain viable against unpatched legacy hosts inside segmented networks; this hunt validates whether network IDS alone - without EDR on every host - can catch the pivot before ransomware-stage impact.
Step 2: Data Sources and Scope
- Sources: Network IDS/IPS (Snort/Suricata alerts); supplementary firewall/NetFlow for the preceding port sweep; Sysmon (process creation) on the two hosts that show exploit success.
- Scope: ~2022-04-16T09:00:00-09:12:00 UTC; Source: WKS-ENG-014 (10.40.2.55); Targets: 10.40.2.56-10.40.2.90 (subnet sweep), successful exploitation on 10.40.2.61 and 10.40.2.73.
- SIEM Queries (Splunk/ELK):
- Exploit signature hits:
index=ids signature="ETERNALBLUE" OR signature="MS17-010" | stats count by src_ip, dest_ip | sort -count - Preceding port sweep:
index=firewall dest_port=445 | stats dc(dest_ip) as unique_targets by src_ip | where unique_targets > 20 - Post-exploit process spawn:
index=sysmon EventID=1 ParentImage="spoolsv.exe" Image="cmd.exe"
Step 3: Key Findings
Parsed events (9 shown) confirm a /24 SMB sweep from a single compromised host followed by successful EternalBlue-pattern exploitation of two targets.
| Timestamp (UTC) | Src IP | Dest IP | Event | IOC/Why Suspicious? |
|---|---|---|---|---|
| 2022-04-16 09:00:02 | 10.40.2.55 | 10.40.2.56-90 | Firewall: 35 distinct TCP/445 SYNs in 8 seconds | Sweep IOC: rapid-fire port 445 probing across the subnet - no legitimate user activity resembles this pattern. |
| 2022-04-16 09:01:15 | 10.40.2.55 | 10.40.2.61 | IDS: ET EXPLOIT Possible ETERNALBLUE MS17-010 Echo Response | First confirmed exploit signature hit - SMBv1 crafted packet matched. |
| 2022-04-16 09:01:16 | 10.40.2.55 | 10.40.2.61 | IDS: SMB1 Trans2 Secondary Response Kernel Memory Corruption | Corroborating second signature on the same host/second - high-confidence exploit attempt, not a false-positive single hit. |
| 2022-04-16 09:01:22 | - | 10.40.2.61 | Sysmon EventID=1: spoolsv.exe spawns cmd.exe /c whoami | Post-exploit IOC: SYSTEM-level process spawning a command shell immediately after the exploit signature - consistent with successful DoublePulsar-style payload execution. |
| 2022-04-16 09:03:40 | 10.40.2.55 | 10.40.2.73 | IDS: same two signatures repeated | Second successful target - confirms lateral, not isolated, exploitation. |
| 2022-04-16 09:03:47 | - | 10.40.2.73 | Sysmon EventID=1: spoolsv.exe spawns cmd.exe | Identical post-exploit pattern on the second victim - automated/scripted exploitation tool, not manual one-off. |
| 2022-04-16 09:04:10 | 10.40.2.55 | 10.40.2.58, .62, .67 | IDS: exploit signature attempted, no post-exploit process observed | Failed attempts: three additional targets received the exploit packets but show no SYSTEM process spawn - likely already patched (MS17-010 applied), demonstrating the exploit's selectivity to unpatched hosts. |
| - | - | (change calendar) | N/A | Legitimacy check IOC: no scheduled vulnerability scan is logged for this subnet/window, and the known Nessus scanner IP (10.40.1.5) does not match the source of these alerts. |
| 2022-04-16 09:12:00 | 10.40.2.55 | (sweep ends) | N/A | Sweep and exploitation activity ceases after ~12 minutes - consistent with a single automated lateral-movement burst (e.g., a worming SMB module) rather than ongoing manual activity. |
Validation:
- Timeline: Port sweep → exploit signature hits → SYSTEM process spawn on two hosts, all within 12 minutes - a textbook automated SMB-exploit lateral movement chain.
- False Positives: Confirmed no scheduled scanner activity matches; three targets receiving the exploit without a resulting process spawn indicate real differential vulnerability (patched vs. unpatched), which supports exploit legitimacy rather than IDS noise.
- Correlation: Single source host for both the sweep and exploitation; two of five attempted targets succeeded, aligning with a realistic mixed-patch-level environment.
Step 4: Recommendations & Next Steps
- Immediate Response: Isolate WKS-ENG-014, 10.40.2.61, and 10.40.2.73 from the network immediately; disable SMBv1 across the subnet if not already done; patch MS17-010 on all remaining hosts in the /24; hunt for further lateral movement or persistence installed via the two successful exploits.
- Detection: Sigma-style rule:
title: SMBv1 Exploit Signature Followed by Privileged Process Spawn→selection1: ids_signature contains 'ETERNALBLUE' | selection2 (within 60s, same dest): sysmon EventID=1 ParentImage contains 'spoolsv.exe'- chain-correlate network and host telemetry for high-confidence alerting. - Pro Tip: Where SMBv1 cannot be immediately disabled (legacy application dependency), compensating network segmentation and IDS signature tuning for MS17-010 patterns should be treated as a standing high-priority alert, not a hunt-only finding - this class of exploit is trivially automatable and often precedes ransomware deployment.
Hypothesis confirmed - automated subnet-wide SMB exploitation via an EternalBlue-pattern attack successfully compromised two additional hosts through lateral movement!