Evidence
Evidence
One observation, and where it came from.
fs-04 accepted a malformed SMBv1 transaction from fin-034 of the shape used to execute code on an unpatched service
This observation is part of a written scenario. It did not come off a real network, and nothing on this deployment did.
{
"kind": "security",
"detection_type": "smb_remote_code_execution",
"principal": "fs-04",
"source_address": null,
"asset": null,
"confidence": 0.94
}