Ransomware Series: Internal Network Sweep on SMB/RDP/WinRM Ports Preceding Lateral Movement

Ibrahim Saud@tektrix

•updated Sep 25, 2026•1•0•4

This rule detects a single host performing a high volume of connection attempts to internal IP addresses across standard management and file-sharing ports (SMB 445, RDP 3389, WinRM 5985) within a 5-minute window. Such behavior is characteristic of network scanning or reconnaissance activities performed by adversaries attempting to identify targets for lateral movement.