SMB is a protocol that allows devices to perform a number of functions on each other via a (usually local) network. SMB exists for so long and supports so much backward compatibility that it contains an almost absurd amount of rudimentary functions, but its modern use of the kernel is simpler than it seems. Its huge size, rare documentation and a wide range of applications can make it one of the most frightening protocols for junior analysts.
There are a lot of guidelines on some aspects of the STB, but the author of this article found a lack of materials that were available, thorough and focused on network analysis. This guide is available in PDF. The purpose of this guide is to explain this confusing protocol in such a way as to help new analysts immediately begin to search for threats with it in their networks, ignoring unnecessary trivia. this guide is an attempt to explain the SMB protocol from a network point of view, discussion of host-based information (for example, Windows logs) has been omitted.
More.
