SMB Security Assessment

This guide treats SMB servers, file shares, and Windows administrative file services as a control boundary rather than a list of attack commands. First document who owns it, who should reach it, what identity context applies, and which data or downstream systems it can affect.

• Confirmed asset owner and in-scope address or application.
• Expected clients, identities, and network zones.
• Protocol versions, encryption expectations, and authentication mode.
• Sensitive data classes and downstream dependencies.
• Monitoring owner, escalation contact, and agreed stop threshold.

1. 01

   Map servers, shares, owners, user groups, and expected network zones.

2. 02

   Record SMB dialect and signing requirements.

3. 03

   Classify business, administrative, deployment, and public shares.

4. 04

   Define synthetic files and test accounts before permission checks.

smbclient -L //192.0.2.10 -U designated-test-user

A useful result demonstrates a broken security expectation with a reversible, low-impact test. Scanner labels and version matches are leads; validate the actual control and preserve the clean baseline beside the changed request.

1. 01

   Confirm guest and anonymous listing are disabled unless documented.

2. 02

   Use test accounts to compare share and file-system permissions.

3. 03

   Verify SMB signing and encryption policy on required boundaries.

4. 04

   Check that administrative shares are restricted to managed administration paths.

ASSET / ENDPOINT:
SCOPE REFERENCE:
IDENTITY / NETWORK ZONE:
BASELINE:
CONTROL TESTED:
EXPECTED RESULT:
OBSERVED RESULT:
TIMESTAMP / REQUEST ID:
SANITIZED EVIDENCE:
STOP / CLEANUP STATUS:

• Audit share access, permission changes, unusual enumeration, and large transfers.
• Alert on legacy dialect negotiation and guest use.
• Correlate access with identity, device, and data classification.

Keep raw data only when it is necessary to reproduce the finding. Redact credentials, session values, customer content, internal addresses, and personal data before evidence enters a ticket or report.

• Disable SMBv1 and require signing where appropriate.
• Remove broad share and NTFS permissions.
• Segment file services from untrusted networks.
• Review dormant shares and privileged groups continuously.