Gentlemen - SMB Network Scanning (T1046)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•4

Identifies the encryptor rapidly scanning the local subnet on Port 445 (SMB) to locate neighboring hosts for propagation. This rule specifically looks for a single device initiating network connections to more than 20 unique IP addresses on port 445 within a one-minute window.