# What are the early warning signs of ransomware on a network?

Regular connections from a workstation to a new outside server, one host scanning internal ranges for SMB, RDP or database ports, new administrator sessions to many servers, and a large upload to cloud storage from a server that normally sends little. They usually come in that order, before any file is encrypted.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/what-are-the-early-warning-signs-of-ransomware-on-a-network

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [Can network monitoring detect ransomware before encryption?](https://netsenx.com/en/faq/can-network-monitoring-detect-ransomware-before-encryption)
- [Does NetSenX stop ransomware?](https://netsenx.com/en/faq/does-netsenx-stop-ransomware)
- [What should we do first if we see these signs?](https://netsenx.com/en/faq/what-should-we-do-first-if-we-see-these-signs)
- [What should we do first if we are hit by ransomware?](https://netsenx.com/en/faq/first-steps-after-a-ransomware-attack)
- [What are the steps after a ransomware attack, in order?](https://netsenx.com/en/faq/steps-after-a-ransomware-attack-in-order)