SmbTraffic - description

The SmbTraffic behavior pattern reflects ransomware activity during the encryption of data on a shared drive. During this process, ransomware typically downloads data from a network share to a client device, encrypts it locally, and then uploads the encrypted files back to the share.

Flowmon ADS detects SMB traffic patterns that may indicate ransomware activity targeting network shares.