Overview
Detect SMBV1 Servers
This scenario simulates the detection of servers still supporting or running SMBv1 (Server Message Block version 1) — an outdated and insecure file-sharing protocol that poses serious risks to enterprise networks. SMBv1, originally designed in the 1980s, lacks modern security features such as encryption, integrity checking, and safe negotiation. It is vulnerable to a wide range of attacks, most notoriously exploited by the WannaCry and NotPetya ransomware campaigns.
Despite its obsolescence, SMBv1 may still be active in legacy environments, especially in older Windows systems or misconfigured devices like printers, NAS systems, and IoT devices. This scenario helps identify those systems by sending tailored SMB negotiation requests and analyzing the protocol versions supported in the server response. The goal is to highlight endpoints that expose SMBv1 to the network, allowing organizations to inventory, isolate, upgrade, or decommission these insecure systems. Removing SMBv1 is widely considered a baseline security measure and is recommended by Microsoft and other cybersecurity authorities.
Objective:
- Identify servers that support or default to SMBv1.
- Help organizations phase out deprecated and insecure file-sharing protocols.
- Improve visibility into legacy systems and protocol exposure.
Use Case:
- Network hardening and hygiene assessments.
- Regulatory compliance checks (e.g., PCI-DSS, CIS benchmarks).
- Red team/purple team scenarios involving vulnerability discovery.
- Risk mitigation planning for legacy system deprecation.
Tactics & Techniques:
- Tactic: Discovery (MITRE ATT&CK: TA0007)
- Technique: Remote System Discovery – [T1018]
- Sub-technique: SMB Protocol Enumeration
Impact:
The scenario does not attempt exploitation or authentication but sends harmless protocol negotiation requests. It is safe for use in production environments. However, it may trigger alerts in intrusion detection systems (IDS) or endpoint monitoring tools due to network scanning behavior.
Detection Tips:
Security teams should monitor for:
- SMB negotiations where the server responds with support for SMBv1 dialects, such as
NT LM 0.12. - Connections to port 445/TCP where SMBv1 is advertised.
- Deprecated negotiation capabilities in Windows Event Logs or packet captures.
- Network IDS (e.g., Zeek, Suricata, Snort) and tools like Microsoft Defender for Endpoint can help detect SMBv1 traffic. Alerts should be correlated with asset inventories to prioritize remediation.
Recommended Mitigations:
- Disable SMBv1 on all systems via Group Policy or registry settings.
- Upgrade or replace legacy systems that depend on SMBv1.
- Block SMBv1 traffic at network boundaries using firewalls.
- Implement segmentation and access controls for high-risk devices.
References:
- Microsoft Security Advisory: SMBv1 Deprecation
- US-CERT Alert TA17-132A: Indicators Associated with WannaCry Ransomware