While analyzing Zeek conn.log entries, an analyst observes thousands of short-duration (< 1 second) connections from one internal host to 254 unique internal IPs on port 445. What does this traffic pattern most likely indicate?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — when one internal host hits 254 unique IPs on port 445 in under a second, you're looking at a horizontal SMB sweep. That's classic lateral movement reconnaissance or worm activity, not normal browsing.
Full Explanation
The correct pattern is an internal host scanning the network for SMB-accessible systems, consistent with lateral movement reconnaissance or a worm spreading, because thousands of short-duration connections from one host to 254 unique internal IPs on TCP port 445 form a classic host-sweep, or horizontal scan, on the SMB port. Normal SMB file share browsing activity is wrong because legitimate SMB browsing does not contact 254 unique hosts in rapid succession. A backup agent performing incremental file backups is wrong because backup agents contact a single backup server, not the entire subnet. Network printer discovery via mDNS is wrong because mDNS uses UDP port 5353, not TCP port 445.