Threat Hunting Exercise: Analyzing Firewall SMB Null Session Enumeration Dataset

This hunt uses a simulated internal segmentation-firewall dataset (fw_smb_nullsession_2022-11-05T140200.json) capturing T1135: Network Share Discovery combined with T1046: Network Service Discovery, where an attacker uses anonymous/null SMB sessions to enumerate shares, users, and groups across many internal hosts as a precursor to lateral movement.

Step 1: Hypothesis Formation

Hypothesis: A single internal host initiates SMB (TCP/445) connections to an unusually large number of distinct internal IP addresses in a short window, with a high proportion of the sessions using anonymous/null authentication, indicating a network-share and account-enumeration sweep rather than normal file-server access. Indicators:

• One source host connects to dozens-to-hundreds of distinct internal hosts on TCP/445 within minutes.
• SMB session-setup logs show NULL or ANONYMOUS LOGON authentication rather than a named domain account.
• Enumerated shares/pipes include IPC$, SRVSVC, or SAMR - consistent with tools like enum4linux, smbclient, or NetSess.
• Source host is a standard workstation, not an authorized vulnerability-scanner or asset-discovery appliance.

Null Hypothesis: The traffic originates from an approved vulnerability-management or asset-discovery scanner performing its scheduled internal sweep. Invalidate by checking the source IP against the organization's authorized-scanner inventory and scan-schedule calendar.

Rationale: Null-session SMB enumeration is an old but still-effective reconnaissance technique because many internal segments retain legacy SMB configurations for compatibility, and the resulting traffic can be mistaken for benign network-management activity unless authentication type and source-host role are examined together.

Step 2: Data Sources and Scope

• Sources: Internal segmentation-firewall/switch NetFlow logs; Windows Security Event Logs (Event ID 4624 Logon Type 3); authorized-scanner inventory.
• Scope: ~2022-11-05T14:02:00-14:31:00 UTC; Host: WKS-CORP-207 (10.12.44.19); Targets: 187 distinct internal hosts across 4 VLANs.
• SIEM Queries (Splunk/ELK):
• index=firewall dest_port=445 | stats dc(dest_ip) as targets by src_ip | where targets > 30
• Null-session confirmation: index=windows EventCode=4624 LogonType=3 AuthenticationPackageName="NTLM" AccountName="ANONYMOUS LOGON" src_ip="10.12.44.19"
• Scanner-inventory check: | lookup authorized_scanners src_ip OUTPUT is_authorized | where is_authorized=false

Step 3: Key Findings

Parsed events (5 shown) confirm WKS-CORP-207 conducted an anonymous SMB enumeration sweep against 187 internal hosts, immediately following execution of a known enumeration toolkit.

Validation:

• Timeline: enumeration-tool execution, followed immediately by a broad, cross-VLAN, null-session SMB sweep hitting domain controllers and file servers - a textbook reconnaissance chain.
• False Positives: source host does not appear in the authorized-scanner inventory or scan schedule.
• Correlation: tool execution, anonymous-logon evidence, and abnormal SMB fan-out jointly confirm deliberate network and account enumeration.

Step 4: Recommendations & Next Steps

• Immediate Response: Isolate WKS-CORP-207, review its recent authentication and process history for the initial compromise vector, and audit domain controllers/file servers for any subsequent authentication attempts using account names harvested during the enumeration window.
• Detection: Sigma-style rule: title: SMB Anonymous Logon Enumeration Sweep → selection: EventCode=4624 LogonType=3 AccountName="ANONYMOUS LOGON" | stats dc(dest_ip) as targets by src_ip | where targets > 10 → condition: selection.
• Pro Tip: Disable anonymous SAM/LSA enumeration (RestrictAnonymous=2) and null-session access to IPC$ domain-wide via GPO - this single hardening step eliminates the most common low-cost reconnaissance path attackers use before attempting credentialed lateral movement.

Hypothesis confirmed - a compromised corporate workstation ran a known SMB enumeration toolkit and conducted a 187-host, cross-VLAN anonymous-logon sweep against internal file servers and domain controllers!