Internal /24 SMB (TCP/445) sweep preceding ransomware share encryption

Ibrahim Saud@tektrix

•updated Sep 18, 2026•2•0•2

Detects high-frequency connection attempts to TCP port 445 within the internal network or across RFC1918 subnets, indicating potential reconnaissance activity such as SMB share scanning commonly associated with lateral movement or network mapping.