Regin USES Server Message Block
Regin used SMB as one of several covert transport channels.
Explicit Confidence 96% · Jack Rhysider EP 48 Details
“A lot was done over your typical SSL and even SMB.”
Protocol
protocol:server_message_block
Also: SMB, shared drives
Network protocol David mentions as a means of remotely accessing systems and passing credentials through a compromised environment.
Shared-drive or network-sharing mechanism implicated in the malware’s spread between connected systems.
“Computers that were connected to the same shared drives as the virus were also getting infected”
Network protocol David mentions as a means of remotely accessing systems and passing credentials through a compromised environment.
“your net bios, your SMB, passing the hash”
Protocol mentioned as one of the covert transport channels used by Regin.
“A lot was done over your typical SSL and even SMB.”
A Windows networking function or protocol used for sharing information between machines and associated in the episode with the vulnerability exploited by EternalBlue.
“a Windows function called Server Message Block that allows machines to essentially share information”
“with SMB [00:55:00] vulnerability”
Not established in the transcript.
Not established in the transcript.
Not mentioned in the transcript; no SMB entity extracted.
Not established in this episode; no evidence extracted.
Not established in the transcript; no SMB-specific entity is extracted.
Not established in the episode; no specific file-sharing protocol is named. The episode instead discusses Remote Desktop and VPN access.
Not established in the transcript.
Not established in the episode.
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | Regin | Explicit | 48 |
| incoming | AFFECTS | SMB vulnerability | Explicit | 54 |
Regin USES Server Message Block
Regin used SMB as one of several covert transport channels.
Explicit Confidence 96% · Jack Rhysider EP 48 Details
“A lot was done over your typical SSL and even SMB.”
SMB vulnerability AFFECTS Server Message Block
The vulnerability EternalBlue exploited was in the Windows Server Message Block function.
Explicit Confidence 99% · Andy Greenberg EP 54 Details
“EternalBlue which exploited a vulnerability in a Windows function called Server Message Block”