DFIRHub

Windows event log · Microsoft-Windows-SmbClient/Connectivity30806 SMB Client: The client re-established its session to the server

  • Windows operational
  • 3 fields
  • Microsoft-Windows-SmbClient%4Connectivity.evtx
  • Microsoft-Windows-SMBClient

Fields EvtxECmd extracts

3 columns in the EvtxECmd CSV

  • PayloadData1TargetServerAddress: %Address%
    • %Address% = /Event/EventData/Data[@Name="Address"]
  • PayloadData2TargetServerName: %ServerName%
    • %ServerName% = /Event/EventData/Data[@Name="ServerName"]
  • PayloadData4SessionId: %SessionId%
    • %SessionId% = /Event/EventData/Data[@Name="SessionId"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-SMBClient" Guid="988c59c5-0a1c-45b6-a555-0c62276e327d"/>
    <EventID>30806</EventID>
    <Version>2</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x400000000000040</Keywords>
    <TimeCreated SystemTime="2018-11-13 10:08:12.7591797"/>
    <EventRecordID>71</EventRecordID>
    <Correlation/>
    <Execution ProcessID="4" ThreadID="1012"/>
    <Channel>Microsoft-Windows-SmbClient/Connectivity</Channel>
    <Computer>HOSTNAME</Computer>
    <Security/>
  </System>
  <EventData>
    <Data Name="Status">0</Data>
    <Data Name="SessionId">52776558133260</Data>
    <Data Name="TreeId">0</Data>
    <Data Name="ServerNameLength">17</Data>
    <Data Name="ServerName">\SERVERNAME.local</Data>
    <Data Name="AddressLength">16</Data>
    <Data Name="Address">port IP address in hex</Data>
  </EventData>

References

1 link

Source: evtx/Maps/Microsoft-Windows-SmbClient-Connectivity_Microsoft-Windows-SMBClient_30806.map(opens in new tab) by Gabriele Zambelli @gazambelli and contributors(opens in new tab), MIT License(opens in new tab)