AddySec AddySec
Practice / Troubleshooting

Firewall deny spike investigation

intermediate

Sample content — demonstrates the Troubleshooting template.

The log excerpt

date=2026-07-20 time=03:14:02 action=deny srcip=10.0.12.44 dstip=185.22.14.9 dstport=445 service=SMB
date=2026-07-20 time=03:14:03 action=deny srcip=10.0.12.44 dstip=185.22.14.11 dstport=445 service=SMB
date=2026-07-20 time=03:14:04 action=deny srcip=10.0.12.44 dstip=185.22.14.13 dstport=445 service=SMB
... (200+ more, sequential destination IPs, all dstport=445, all within 90 seconds)

Investigate

What’s actually happening here, and what would you check on 10.0.12.44 next?

Analysis

The same internal host is hitting sequential external IPs on port 445 (SMB) in rapid succession — this is a classic scanning/worm-propagation pattern, not normal user traffic. Legitimate SMB use targets specific known servers, not a range of external addresses.

Next steps

  • Isolate 10.0.12.44 from the network immediately.
  • Check the host for signs of compromise (unexpected processes, outbound connections, recent binaries).
  • Confirm the firewall policy is correctly denying outbound SMB to the internet by default — this traffic should never have reached the firewall as “allowed” in the first place.