F019Inconclusivevalidator: blocked
SMB connection to internal host 172.16.6.14 port 445
172.16.6.14:445
Analyst narrative
Established TCP connection from local system 172.16.6.11 to 172.16.6.14:445 (SMB) with high-numbered source port 65368. Indicates lateral movement or remote file access.
Proof chain · 0 facts
Every confirmed claim links by foreign key to the typed fact that validated it, and to the forensic tool that produced that fact. This is one finding_trace() query.
Source tools
vol_netscan