Suspicious Rejected SMB Guest Logon From IP

Title: Suspicious Rejected SMB Guest Logon From IP
Status: test
Description:Detect Attempt PrintNightmare (CVE-2021-1675) Remote code execution in Windows Spooler Service
References:
  -https://twitter.com/KevTheHermit/status/1410203844064301056
  -https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/
  -https://web.archive.org/web/20210701042336/https://github.com/afwu/PrintNightmare
Author: Florian Roth (Nextron Systems), KevTheHermit, fuzzyf10w
Date: 2021-06-30
modified:2023-01-02
Tags:

• -'attack.credential-access'
• -'attack.t1110.001'

Logsource:

• product: windows
• service: smbclient-security

Detection:
  selection:
    EventID: '31017'
    UserName: ''
    ServerName|startswith: '\1'
  condition:selection
Falsepositives:
  -Account fallback reasons (after failed login with specific account)
Level: medium