This counts detected anonymous, or null, SMB session attempts, a legacy Windows feature letting a client connect to a share without providing credentials. Null sessions are a well-known reconnaissance technique for enumerating usernames, shares, and system information without authenticating, so admins watch this counter to catch someone probing internal Windows file shares anonymously, often a precursor to a credential-based attack. For example, a spike in null-session attempts from a single internal IP suggesting a compromised host is enumerating domain shares before attempting lateral movement.