win_security_successful_external_remote_smb_login

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•2•0•32

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.