Smb Ipc Netlogon Samr Srvsvc Rpc Chain

Session containing IPC$ share access, NETLOGON share access, root directory read, SAMR RPC bind, and SRVSVC pipe open with subsequent RPC bind. Represents this specific chained SMB RPC interaction pattern within a single session.

Observed IPs

Avg Confidence

98%

Severity

high

Top IPs by event countSMB

IP Address	Risk	Events	Sessions	Country	ASN	Last Seen
35.216.144.195	100%	5,565	2,678	🇨🇭 CH	AS15169	2026-04-25
35.216.195.77	100%	5,217	2,116	🇨🇭 CH	AS15169	2026-04-25
35.216.189.16	100%	4,009	1,739	🇨🇭 CH	AS15169	2026-04-25
35.216.172.131	100%	3,165	1,234	🇨🇭 CH	AS15169	2026-04-10
35.216.201.9	100%	2,720	1,285	🇨🇭 CH	AS15169	2026-04-22
34.22.151.18	100%	2,129	340	🇧🇪 BE	AS396982	2026-02-25
35.187.31.145	99%	1,748	479	🇧🇪 BE	AS396982	2026-02-27
35.216.183.140	100%	1,746	472	🇨🇭 CH	AS15169	2026-04-13
34.76.200.20	98%	1,715	263	🇧🇪 BE	AS396982	2026-02-26
34.34.132.221	100%	1,648	570	🇧🇪 BE	AS396982	2026-03-26
34.140.92.201	99%	1,551	691	🇧🇪 BE	AS396982	2026-03-16
34.77.70.250	97%	1,463	416	🇧🇪 BE	AS396982	2026-02-24
34.14.103.46	100%	1,352	467	🇧🇪 BE	AS396982	2026-02-27
35.195.241.97	100%	1,318	612	🇧🇪 BE	AS396982	2026-03-21
34.78.138.227	98%	1,306	313	🇧🇪 BE	AS396982	2026-03-10
34.78.177.87	100%	1,295	399	🇧🇪 BE	AS396982	2026-03-02
104.199.46.221	99%	1,283	437	🇧🇪 BE	AS396982	2026-02-28
34.140.203.250	99%	1,282	359	🇧🇪 BE	AS396982	2026-02-24
34.76.44.148	97%	1,228	348	🇧🇪 BE	AS396982	2026-02-23
35.216.156.249	100%	1,132	1,041	🇨🇭 CH	AS15169	2026-04-13