Troubleshoot QID 379223: SMBv1 Detection on Windows Systems

Problem

You can see QID 379223 reported on Windows systems. The vulnerability indicates that SMBv1 is detected during remote or authenticated scans. You want to verify the detection using packet capture or system inspection.

Remote detection uses specially crafted SMBv1 negotiation packets. The Negotiate Protocol Request initiates SMB communication. SMB command 0x72 represents this request, and error code 0x00 indicates a successful operation. Frames such as 3211 (request) and 3213 (response) confirm the negotiation. The use of the NT LM 0.12 dialect confirms SMBv1 usage.

Authenticated detection relies on registry and WMI validation. SMBv1 is an older protocol and lacks modern security enhancements.

Cause

SMBv1 is enabled on the Windows system. During remote detection, the scanner sends SMBv1 negotiation requests to the target. If the response contains SMBv1 protocol elements, the system is flagged. During authenticated detection, the scanner checks the following system configuration:

• If the registry value SMB1 = 1 under HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters, SMBv1 is enabled.
• If the WMI query for SMB1Protocol returns InstallState = 2, SMBv1 is enabled.

Solution

Verify Remote Detection

To verify remote detection:

1. Generate a packet capture during the vulnerability scan.
2. Download the PCAP file after the scan completes, and open the file in Wireshark.
3. Apply the display filter smb to view SMBv1 packets.
4. Locate a Negotiate Protocol Request packet.
5. Right-click the packet and select Follow > TCP Stream.
6. Review the TCP stream to confirm SMBv1 negotiation.
7. Verify that NT LM 0.12 dialect is used.
8. Confirm the response details such as Max Buffer Size and Max Mpx Count.

Verify Authenticated Detection

To verify authenticated detection:

1. Log in to the Windows system.
2. Open Registry Editor and navigate to HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters.
3. Check the SMB1 value. If it is set to 1, SMBv1 is enabled.
4. Run the following PowerShell command: Get-WmiObject -Namespace root/cimv2 -Query "select * from Win32_OptionalFeature where name='smb1protocol'"
5. Check the InstallState value.
   If the value equals to 2, SMBv1 is enabled.