AirDrop/Quick Share DoS - Repeated Inbound Connection Attempts

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•3

Detects high frequency inbound network connection attempts or accepted connections initiated by common file sharing processes (e.g., NearShare.exe, NearbySharing.exe, quickshare.exe, sharingd, airplayd). A high volume of inbound connection attempts may indicate brute force, discovery, or malicious scanning behavior using legitimate file sharing tools as a conduit.