| it is likely that the outbound server message block (smb) traffic is legitimate, if the company's internal networks are not well-defined in the assets and identity framework. categorize the internal cidr blocks as `internal` in the lookup file to avoid creating notable events for traffic destined to those cidr blocks. any other network connection that is going out to the internet should be investigated and blocked. best practices suggest preventing external communications of all smb versions and related protocols at the network boundary. | |
LoFP
/
T1071.002