OS Attack: Microsoft SMB MS17-010 Disclosure Attempt.
SMB v1 on SMB Server
| Detect: | sc.exe query lanmanworkstation |
| Disable: | sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi sc.exe config mrxsmb10 start= disabled |
| Enable: | sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi sc.exe config mrxsmb10 start= auto |
For more information, see Server storage at Microsoft
SMB v2/v3 on SMB Server
| Detect: | sc.exe query lanmanworkstation |
| Disable: | sc.exe config lanmanworkstation depend= bowser/mrxsmb10/nsi sc.exe config mrxsmb20 start= disabled |
| Enable: | sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi sc.exe config mrxsmb20 start= auto |