Explorer Outbound SMB Connection to External IP

Brandon Rodriguez@BMRodriguez

•updated Apr 27, 2026•27•1•1,239

Detects Windows Explorer (explorer.exe) initiating outbound network connections over port 445 (SMB) to non-private, external IP addresses. This behavior aligns with the zero-click authentication coercion vulnerability (CVE-2026-32202) where Explorer automatically reaches out to a remote UNC path to fetch an icon resource, leaking NTLM hashes.