TCP Port 445 – SMB / Microsoft-DS (Windows File Sharing)

Port 445 is the primary port for SMB, the Server Message Block protocol that Windows networks use for file sharing, printer sharing, and a wide range of administrative communication between machines. When a user opens a shared folder on a colleague’s computer, when a domain-joined workstation authenticates to a domain controller, when Group Policy applies settings to a managed PC, or when an automated backup system pulls files from a Windows server, the underlying connection often runs through SMB on port 445. The IANA assignment registers it as “microsoft-ds” (Microsoft Directory Services).

Port 445 was introduced in Windows 2000 as a streamlined replacement for the older NetBIOS-over-TCP transport, which used ports 137, 138, and 139. Where the older arrangement layered SMB on top of NetBIOS for naming and session management, port 445 carries SMB directly over TCP. Both transport methods continued to exist for years, with newer Windows versions preferring port 445 and falling back to NetBIOS only when needed. Modern Windows networks rely almost exclusively on port 445 for SMB.

Port 445 is essential within a Windows network, where it carries the bulk of normal file-sharing and administrative traffic. It is also one of the most security-significant ports on the public internet, due to a series of major SMB vulnerabilities and the rapid spread of worms and ransomware that exploited them. Outbound TCP/445 from end-user devices is normal within a corporate or home Windows network and uncommon to internet destinations. Inbound TCP/445 from the public internet to any host is unusual in 2026 and is widely treated as a serious exposure.

Port 445 is also defined for UDP in the IANA registry, but UDP/445 is not used in practice. SMB requires the reliable, ordered, persistent connections that TCP provides.

About TCP Port 445

The Internet Assigned Numbers Authority (IANA) registers port 445 for microsoft-ds. The IANA description reads: ‘Microsoft-DS’.

Security Considerations

Port 445 has one of the most consequential security histories of any port on this list. Several of the most damaging cyberattacks of the past decade exploited vulnerabilities in SMB on port 445, and the protocol remains a primary target for both opportunistic ransomware and targeted intrusion campaigns.

The defining events were in 2017. EternalBlue, a Windows SMB exploit developed by the United States National Security Agency and leaked publicly by the Shadow Brokers group in April 2017, allowed remote code execution against unpatched Windows systems with port 445 exposed. Microsoft had patched the underlying vulnerability (CVE-2017-0144, in MS17-010) one month before the leak, but a large number of systems remained unpatched. Within weeks, the WannaCry ransomware swept through hospitals, companies, and government networks worldwide, encrypting files on hundreds of thousands of machines. The NotPetya wiper followed in June 2017, using the same EternalBlue mechanism alongside other propagation methods to cause an estimated $10 billion in damage, primarily through enterprise networks in Ukraine and globally. The DoublePulsar implant, which is also named in our dataset, was the kernel-mode backdoor that EternalBlue typically installed on a successfully exploited host.

Beyond the EternalBlue family of events, port 445 carries a long history of SMB vulnerabilities and post-compromise activity. The IDS rules referencing this port include detections for buffer overflows in SMB session-setup handling, DCERPC bind attempts, and unauthorized access to administrative shares like ADMIN$. Curated malware families on port 445 include the Duqu espionage framework (MITRE S0038), Mimikatz (MITRE S0002, a credential-extraction tool used to harvest Windows password hashes that can then authenticate to SMB shares for lateral movement), the BlackEnergy intrusion framework (MITRE S0089) used in the 2015 and 2016 Ukrainian power grid attacks, the HermeticWizard SMB-spreading wiper (MITRE S0698) deployed in Ukraine in 2022, and the Sliver post-exploitation framework (MITRE S0633).

Common practice today is unambiguous: do not expose port 445 to the public internet. Modern Windows hosts and home routers block inbound 445 by default, and most ISPs filter it at the network edge to limit worm propagation. Within a corporate network, SMB should be restricted to known internal ranges, kept patched against the latest Microsoft security updates, and configured with SMB signing and SMB encryption enabled where the version supports them.

Inbound TCP/445 from the public internet to any host is a strong indicator of either a serious misconfiguration or an active attack scan and warrants immediate investigation.

IDS Rule References

138 IDS / security rules reference TCP port 445. Treat that number as context, not a danger score. Many detection rules are written against groups of ports rather than one service, web ports especially, so common web alternate ports inherit large counts while genuinely sensitive services can show few rules or none. Presence in IDS rules does not mean traffic on this port is malicious.

Rule categories (top 6): trojan-activity (56), protocol-command-decode (36), attempted-admin (14), attempted-recon (8), attempted-user (5), misc-activity (4).

Sample rule descriptions for TCP port 445:

• NETBIOS DCERPC NCACN-IP-TCP srvsvc NetrShareEnum null policy handle attempt
• SQL xp_cmdshell program execution 445
• NETBIOS SMB DCERPC invalid bind attempt
• OS-WINDOWS Microsoft Windows SMB-DS DCERPC Remote Activation bind attempt
• OS-WINDOWS Microsoft Windows SMB-DS DCERPC Messenger Service buffer overflow attempt

Malware Rule References

A meaningful share of the IDS rules that reference this port are malware related.

61 of the 138 IDS rules that reference TCP port 445 are malware related. That describes detection coverage across the whole internet, not anything about your machine or your network.

Families observed (top 8): Duqu (12), Skeleton (9), Mimikatz (4), CryptXXX (3), Dorkbot (3), Locky (3), BasicPipeShell (2), BlackEnergy (2), and 15 more families.

Data Sources

This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), Snort Community Rules (GPLv2), and MITRE ATT&CK (Apache 2.0).