• Platformchevron right
  • Solutionschevron right
  • Modern NDRchevron right
  • Resourceschevron right
  • Companychevron right

DETECTION OVERVIEW

Suspicious SMB File Reads

Risk Factors

It is both relatively easy and not uncommon for attackers to gain access to file shares. Depending on the sensitivity of the files in the accessed file share, the impact can be devastating if it results in a leak of important, proprietary, or customer data.

The system might change the risk score for this detection.

Kill Chain

Actions on Objective

Risk Score

60

Detection diagram
Next in Actions on Objective: Unconventional Data Transfer

Attack Background

After an attacker has compromised a workstation and obtained a valid set of credentials, they can proceed with malicious activity that might be overlooked as normal file share activity. The primary difference is that the attacker is looking for sensitive or valuable information that they can leverage for malicious objections, such as in a data breach.

Mitigation Options

Restrict file share access to only authorized IP addresses and hosts

Add two-factor or multi-factor authentication

Disable anonymous access to file shares

MITRE ATT&CK ID

What else can RevealX do for you?