DFIRHub

Windows event log ยท Microsoft-Windows-SMBServer/Security551 SMB session authentication failure

SPN = Service Principal Name

  • Defender and policy
  • 7 fields
  • Microsoft-Windows-SMBServer%4Security.evtx
  • Microsoft-Windows-SMBServer

Fields EvtxECmd extracts

7 columns in the EvtxECmd CSV

  • UserName%UserName%
    • %UserName% = /Event/UserData/EventData/UserName
  • RemoteHost%ClientName%
    • %ClientName% = /Event/UserData/EventData/ClientName
  • PayloadData1Status: %Status%
    • %Status% = /Event/UserData/EventData/Status
  • PayloadData2SessionGUID: %SessionGUID%
    • %SessionGUID% = /Event/UserData/EventData/SessionGUID
  • PayloadData3ConnectionGUID: %ConnectionGUID%
    • %ConnectionGUID% = /Event/UserData/EventData/ConnectionGUID
  • PayloadData4SessionId: %SessionId%
    • %SessionId% = /Event/UserData/EventData/SessionId
  • PayloadData5SPN: %SPN%
    • %SPN% = /Event/UserData/EventData/SPN

Value lookups

Codes that EvtxECmd turns into text

Status

0xC000003A
The share path does not reference a valid resource
0xC000006D
The server rejected the client logon attempt or incorrect password during logon attempt.
0xC0000205
The server is out of resources. Out of memory or TIDs.
0xC00000CC
The server is temporarily paused or the share path is not valid.
0xC00000CF
The server is temporarily paused.
0xC00000D0
The server has no more connections available.
0xC000000D
Tree connect request after request to end session or internal error.
0x00010002
Invalid SMB. Not enough parameter bytes were sent. Did the client omit a session setup?
0xC0000022
The user is not authorized to access the resource.
0xC00000CB
Resource type invalid. Value of Service field in the request was invalid.
0x005B0002
The UID supplied is not defined to the session.
0xC0000072
User account on the target machine is disabled or has expired.

Sample event

Event XML from the map file

<Event>
  <Event>
    <System>
      <Provider Name="Microsoft-Windows-SMBServer" Guid="d48ce617-33a2-4bc3-a5c7-11aa4f29619e"/>
      <EventID>551</EventID>
      <Version>1</Version>
      <Level>2</Level>
      <Task>551</Task>
      <Opcode>0</Opcode>
      <Keywords>0x810000002200008</Keywords>
      <TimeCreated SystemTime="2020-01-14 00:37:09.4067902"/>
      <EventRecordID>86585</EventRecordID>
      <Correlation/>
      <Execution ProcessID="4" ThreadID="11788"/>
      <Channel>Microsoft-Windows-SMBServer/Security</Channel>
      <Computer>HOSTNAME.domain</Computer>
      <Security UserID="S-1-5-18"/>
    </System>
    <UserData>
      <EventData>
        <SessionGUID>30367936-3631-000a-5a2a-cabc9eb4d501</SessionGUID>
        <ConnectionGUID>30316796-3631-000a-592a-cfff9abcd501</ConnectionGUID>
        <Status>0xC000006D</Status>
        <TranslatedStatus>0xC000006D</TranslatedStatus>
        <ClientAddressLength>128</ClientAddressLength>
        <ClientAddress>02-00-F4-D5-0A-70-8C-8F-00-00-00-00-00-00-00-00-02-00-FF-FF-0A-70-8C-8F-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00</ClientAddress>
        <SessionId>0x17C3930000005</SessionId>
        <UserNameLength>0</UserNameLength>
        <UserName></UserName>
        <ClientNameLength>16</ClientNameLength>
        <ClientName>\\10.123.123.123</ClientName>
        <SPN>session setup failed before the SPN could be queried</SPN>
        <SPNValidationPolicy>0</SPNValidationPolicy>
      </EventData>
    </UserData>
  </Event>

References

6 links

Source: evtx/Maps/Microsoft-Windows-SMBServer-Security_Microsoft-Windows-SMBServer_551.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)