Threat Hunting With Python Part 3: Taming SMB
Summary: A Dragos blog post traces SMB's role in the 2017 WannaCry, Petya and Bad Rabbit attacks back to ETERNALBLUE, an Equation Group tool leaked by the ShadowBrokers on April 14, 2017, which exploited Windows machines running SMBv1. The post then demonstrates hunting SMB authentication traffic with Bro IDS's SMB module and Python's pandas, using a simulated corporate domain (192.168.5.0/24) and PCN subdomain (192.168.6.0/24) and Metasploit's PSExec to generate 12 NTLM log records over 49 minutes.
What you should know: The exercise found the administrator account authenticating twice into the PCN subnet from an engineer's corporate workstation - a pivot the mock organization's own rules say should never happen, and the kind of signal that sits quietly in logs until someone parses them.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026