New Outbound SMB Connection

SMB network traffic does not typically traverse the network perimeter. Any SMB traffic that crosses the network perimeter without authorization should be investigated for signs of malicious activity.

Legitimate external SMB traffic associated with cloud-based instances, port forwarding, or packet filtering at the network perimeter might often look like traffic to unauthorized file servers. Configure Network Localities in the ExtraHop system to classify legitimate external SMB traffic as internal.

The system might change the risk score for this detection.