Port 445 (SMB)
Windows file and printer sharing (Server Message Block) directly over TCP.
- Transport
- TCP
- Internet exposure
- Never expose
Should not be reachable from the internet.
Security notes
- EternalBlue (MS17-010) over SMB spread WannaCry and NotPetya in 2017.
- Used heavily for lateral movement: PsExec, remote services and admin shares.
- NTLM relay attacks target SMB when signing is not required.
When it shows up in your logs
Inbound 445 from the internet is worm or scanner traffic. A workstation connecting to many hosts on 445 can be lateral movement or ransomware spreading.