SMB

Synopsis

Creates an emulated SMB server that drives the SMB2 NEGOTIATE and SESSION_SETUP NTLM exchange far enough to capture an attacker's credentials, then denies the logon by default. Optionally emulates a Domain Controller, exposing SYSVOL/NETLOGON tree connects and, when enabled, a browsable fake Group Policy directory tree. No real shares or files are ever exposed.

Schema

- id: <numeric>
  name: <string>
  description: <string>
  type: smb
  tags: <string[]>
  pipelines: <pipeline[]>
  status: <boolean>
  properties:
    address: <string>
    port: <numeric>
    os_flavor: <string>
    emulate_dc: <boolean>
    domain: <string>
    dns_domain: <string>
    computer_name: <string>
    browsable: <boolean>
    timeout: <numeric>

Configuration

The following fields are used to define the device:

Device

Field	Required	Default	Description
`id`	Y		Unique identifier
`name`	Y		Device name
`description`	N	-	Optional description
`type`	Y		Must be `smb`
`tags`	N	-	Optional tags
`pipelines`	N	-	Optional pre-processor pipelines
`status`	N	`true`	Enable/disable the device

Connection

Field	Required	Default	Description
`address`	N	`"0.0.0.0"`	Listen address
`port`	Y		Listen port. Standard SMB is 445.
`timeout`	N	`20`	Idle timeout in seconds

Emulation

Field	Required	Default	Description
`os_flavor`	N	`server2019`	Windows version advertised in the NTLM challenge

Accepted values are server2012, server2012r2, server2016, server2019, and server2022. Each preset supplies the NetBIOS and DNS computer and domain names, plus the Windows version reported to the client. Scanners and client tools fingerprint the host from these, so the value determines which Windows Server build the honeypot appears to be.

An unrecognized or empty value falls back to server2019 without raising a configuration error.

Domain Controller

Field	Required	Default	Description
`emulate_dc`	N	`false`	Accept the session and expose SYSVOL/NETLOGON tree connects, reading as a Domain Controller
`domain`	N	-	NetBIOS domain name advertised in the NTLM challenge, e.g. `CORP`. Falls back to the `os_flavor` preset when empty
`dns_domain`	N	-	DNS domain name advertised in the NTLM challenge, e.g. `corp.local`. Falls back to the `os_flavor` preset when empty
`computer_name`	N	-	Computer name advertised in the NTLM challenge, e.g. `DC01`. Falls back to the `os_flavor` preset when empty
`browsable`	N*	`false`	Serve a fake SYSVOL/NETLOGON directory tree for CREATE/QUERY_DIRECTORY/READ/QUERY_INFO/CLOSE requests

* = browsable has no effect unless emulate_dc is true

Details

Negotiate and Session Setup

A legacy SMB1 NEGOTIATE is answered with an SMB2 NEGOTIATE response, logging a connection event with dialect set to SMB1->SMB2. A native SMB2 NEGOTIATE gets the same response with dialect set to SMB2. Both responses carry an SPNEGO NegTokenInit.

At SESSION_SETUP, the NTLMSSP token is located within the SPNEGO security buffer by a signature scan. An NTLM NEGOTIATE message gets an NTLM CHALLENGE built from the os_flavor preset with any domain/dns_domain/computer_name overrides applied, plus STATUS_MORE_PROCESSING_REQUIRED. An NTLM AUTHENTICATE message is parsed for the username, domain, workstation, and NT response, and logs an auth_attempt event.

Authentication Modes

`emulate_dc`	Behavior
`false` (default)	Replies `STATUS_LOGON_FAILURE` and closes the connection. Capture-and-deny — no shares are ever exposed
`true`	Replies `STATUS_SUCCESS`, accepting the session

With emulate_dc: true, a TREE_CONNECT is permitted only for SYSVOL, NETLOGON, and IPC$ (IPC$ is presented as a named-pipe share); a request for any other share returns STATUS_BAD_NETWORK_NAME. Every tree connect attempt, granted or not, logs a share_access event. Accessing SYSVOL or NETLOGON is a strong Active Directory reconnaissance signal.

With browsable: true (which requires emulate_dc: true), CREATE, QUERY_DIRECTORY, READ, QUERY_INFO, and CLOSE requests are served from an in-memory fake tree:

SYSVOL/<dns_domain>/Policies/ contains the two default GPO GUID folders — Default Domain Policy and Default Domain Controllers Policy — each with a GPT.INI file plus empty Machine and User directories.
SYSVOL/<dns_domain>/scripts is an empty directory.
NETLOGON/logon.bat is a placeholder script file.

When dns_domain is empty, the tree is built under corp.local. Every CREATE logs a file_access event with the resolved share and path; a request for an unknown path returns STATUS_OBJECT_NAME_NOT_FOUND. No real file contents are ever served.

Logged Events

Every connection generates one or more of the following event types:

`event_type`	Emitted when
`connection`	A NEGOTIATE request is received
`auth_attempt`	An NTLM AUTHENTICATE message is parsed
`share_access`	A TREE_CONNECT is attempted (`emulate_dc` sessions only)
`file_access`	A CREATE request is served against the browsable tree

Event Fields

Every event carries timestamp, event_type, source_ip, source_port, and local_addr. The remaining fields depend on the event type:

Field	Description
`dialect`	Negotiated dialect: `SMB1->SMB2` or `SMB2`
`username`	Username submitted in the AUTHENTICATE message
`domain`	Domain submitted in the AUTHENTICATE message
`workstation`	Workstation name submitted in the AUTHENTICATE message
`auth_method`	Always `ntlm`
`netntlmv2`	Crackable Net-NTLMv2 hash assembled from the challenge and response
`os_flavor`	Configured `os_flavor` preset for the session
`share`	Share name targeted by a TREE_CONNECT or CREATE
`granted`	Whether the tree connect was granted
`path`	Path targeted by a CREATE request

Captured Hashes

netntlmv2 is a hashcat -m 5600 Net-NTLMv2 string.

Examples

The following are commonly used configuration types.

Basic

Creating a minimal SMB honeypot that captures and denies every logon attempt...

devices:
  - id: 1
    name: basic_smb
    type: smb
    properties:
      port: 445

Domain Controller Emulation

Emulating a Domain Controller with a custom identity so authenticated clients can enumerate SYSVOL and NETLOGON...

devices:
  - id: 2
    name: dc_smb
    type: smb
    properties:
      port: 445
      os_flavor: server2019
      emulate_dc: true
      domain: CORP
      dns_domain: corp.local
      computer_name: DC01

Browsable SYSVOL

Serving a fake SYSVOL Group Policy tree to bait reconnaissance tooling into reading GPO files...

devices:
  - id: 3
    name: browsable_smb
    type: smb
    properties:
      port: 445
      emulate_dc: true
      dns_domain: corp.local
      browsable: true

With Pre-Processing

Routing captured attempts through a pre-processing pipeline before ingestion...

devices:
  - id: 4
    name: smb_preprocessed
    type: smb
    pipelines:
      - decoy-honeypot-enrich
    properties:
      port: 445

A failed NTLM logon is logged with the crackable Net-NTLMv2 hash before pipeline processing...

{
  "timestamp": "2026-08-03T09:14:22.481937204Z",
  "event_type": "auth_attempt",
  "source_ip": "203.0.113.44",
  "source_port": "51422",
  "local_addr": "10.0.4.12:445",
  "username": "administrator",
  "domain": "CORP",
  "workstation": "WORKSTATION7",
  "auth_method": "ntlm",
  "netntlmv2": "administrator::CORP:1122334455667788:3af1c9e0d4b27a68f5e13c0a9d2b7614:0101000000000000...",
  "os_flavor": "server2019"
}

Synopsis​

Schema​

Configuration​

Device​

Connection​

Emulation​

Domain Controller​

Details​

Negotiate and Session Setup​

Authentication Modes​

Browsable Share Tree​

Logged Events​

Event Fields​

Captured Hashes​

Examples​

Basic​

Domain Controller Emulation​

Browsable SYSVOL​

With Pre-Processing​