Threat Hunting With Python Part 3: Taming SMB

This third entry in a Python-based threat hunting series examines SMB/CIFS in industrial control networks, recounting how ETERNALBLUE-enabled ransomware (WannaCry, Petya/NotPetya, Bad Rabbit) spread and demonstrating how to hunt SMB authentication activity using Bro/Zeek NTLM logs and Python/pandas to spot risky cross-subnet pivots and misuse of privileged accounts. It walks through a lab simulating corporate and PCN subnets, emphasizes leveraging vendor guidance (e.g., Honeywell EPKS) for expected behaviors, and recommends controls such as blocking SMB between business and PCN to limit lateral movement.