While analyzing Zeek conn.log entries, an analyst observes thousand…

Question

While analyzing Zeek conn.log entries, an analyst observes thousands of short-duration (< 1 second) connections from one internal host to 254 unique internal IPs on port 445. What does this traffic pattern most likely indicate?

Accepted Answer

Internal host scanning the network for SMB-accessible systems, consistent with lateral movement reconnaissance or a worm spreading — Here's the deal — b is correct because rapid sequential connections to 254 hosts on a single port in sub-second durations is a classic host-sweep (horizontal scan) pattern on the SMB port, indicating an attacker or worm enumerating targets for lateral movement. A is wrong because legitimate SMB browsing does not contact 254 unique hosts in rapid succession.

Answer

Normal SMB file share browsing activity

Answer

A backup agent performing incremental file backups

Answer

Network printer discovery via mDNS

While analyzing Zeek conn.log entries, an analyst observes thousands of short-duration (< 1 second) connections from one internal host to 254 unique internal IPs on port 445. What does this traffic pattern most likely indicate?

Short Explanation and Infographic

Full Explanation