SMB Fan-Out Anomaly in a Payment VPC with Container Blind Spots
At FinCo, Illumio Insights monitors 1,200 workloads in a payment VPC. APP-221, a Linux application server, normally sends 300 MB per day to 12 internal IPs on TCP 443. In a six-hour window it sends 4.8 GB to 230 distinct internal IPs on TCP 445 and 15 external IPs on TCP 443. The VEN on APP-221 is healthy and in visibility-only mode. Thirty percent of the VPC's ephemeral containers have no VEN, and the team has no packet capture in that VPC. The on-call analyst sees the anomaly and asks whether to declare a ransomware incident and isolate APP-221. The application owner says APP-221 is a batch job that may scan file shares. The SOC has EDR but the container platform is out of scope.
1. How should the analyst interpret the SMB fan-out, and what evidence would confirm or refute ransomware?
Read the worked answer
The SMB fan-out is high-risk but not conclusive. A Linux application server suddenly sending 4.8 GB to 230 internal hosts on TCP 445 is consistent with lateral movement or a worm that is enumerating and encrypting file shares. It is also consistent with some legitimate batch jobs, backup/indexing tools, or vulnerability scanners, which is why the application owner's claim must be tested rather than dismissed.
Confirmatory evidence should include: the process tree and command line on APP-221 at the start of the anomaly; EDR alerts for credential access, service creation, or file encryption; authentication logs showing unusual SMB logons; file-share audit logs on destination hosts; file extensions or ransom notes on those hosts; DNS and proxy logs for the 15 external IPs; and whether other workloads show the same SMB fan-out. Insights gives flow-level visibility, not payload, so the analyst should not declare ransomware on flow volume alone. But the pattern is serious enough to start containment preparation while evidence is gathered.
2. What are the visibility gaps and how do they affect containment confidence?
Read the worked answer
There are three gaps. First, 30 percent of ephemeral containers have no VEN, so Insights cannot see their east-west traffic. If the malware moved into a container, APP-221 could be isolated while the container continues to spread. Second, there is no packet capture in the VPC, so the team cannot inspect SMB payloads, file names, or command-and-control content. Third, the external 443 flows could be command-and-control, data exfiltration, or a benign update; without proxy or DNS logs the team cannot tell.
Those gaps lower containment confidence. Isolating APP-221 is still worthwhile, but it must be paired with network-level blocks and a hunt across unmanaged containers. The team should treat the VPC as possibly contaminated until container telemetry, VPC flow logs, and EDR data are correlated. The incident response scope should include the container platform even if it is out of the SOC's normal scope.
3. What containment and hunting actions would you take, in order?
Read the worked answer
- Preserve evidence. Snapshot APP-221 and capture memory if possible. Do not reboot or rebuild before collecting the process tree, network connections, and logs.
- Isolate APP-221 with a controlled policy. In the PCE, add an allow rule for the IR jump host and required management, then enforce a deny-all for APP-221 in selective mode. If selective deny-all is too coarse, at minimum deny SMB inbound and outbound and block the 15 external IPs. Switch from visibility-only only after the IR allow rule exists.
- Block SMB at the VPC boundary and between segments. Use security groups or network ACLs to stop TCP 445 from the payment VPC to databases, file shares, and other VPCs. This covers unmanaged containers and hosts that Illumio cannot enforce.
- Hunt for the same pattern. Query Insights and VPC flow logs for other workloads with high fan-out on 445, new external 443 destinations, or encryption-related EDR alerts. Include containers and any host without a VEN.
- Validate the application-owner claim. Check batch schedules and scanner logs. If the traffic is legitimate, roll back the isolation in a controlled change; if not, keep containment and escalate to a full IR.