For more information on securing SMB, you should check out Microsoft's advisories 2696579. Block all versions of SMB at the network boundary by blocking TCP port 445 with related protocols on UDP ports 137-138 and TCP port 139, for all boundary devices. Both SMB and CIFS are also available on VMS. The Common Internet File System (CIFS) is a dialect of SMB. The set of message packets defining a particular version of the protocol is called a dialect.
flow = search Flow:Message smb_events = filter flow where (dest_port = '445' and protocol = 'smb') smb_events.file_name = smb_events.proto_info.file_name output smb_write With the right protocol decoders, port 445 traffic can be filtered and even the file path (relative to the share) can be retrieved.
