drop smb pcap csv or conn log · admin share access · failed auth bursts · export csv · runs locally
flags C$ · ADMIN$ · IPC$ · auth failures · burst >10 fails / 60s
drop tshark smb csv or zeek conn log