Manage SMB

OS Attack: Microsoft SMB MS17-010 Disclosure Attempt.

SMB v1 on SMB Server
Detect: sc.exe query lanmanworkstation
Disable: sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi
sc.exe config mrxsmb10 start= disabled
Enable: sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi
sc.exe config mrxsmb10 start= auto

For more information, see Server storage at Microsoft

SMB v2/v3 on SMB Server
Detect: sc.exe query lanmanworkstation
Disable: sc.exe config lanmanworkstation depend= bowser/mrxsmb10/nsi
sc.exe config mrxsmb20 start= disabled
Enable: sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi
sc.exe config mrxsmb20 start= auto

 

Comments powered by CComment

Designed by san © 2018