After Microsoft patched and went public with %%CVE:2022-26809%%, the recent RPC vulnerability, we set up a complete Windows 10 system exposing port 445/TCP “to the world.” The system is not patched for the RPC vulnerability. And to keep things more interesting, we are forwarding traffic from a subset of our honeypots to the system. This gives us a pretty nice cross-section and keeps the system pretty busy. Other than not applying the April patches, the system isn’t particularly vulnerable and is left in the default configuration (firewall disabled, of course).
Article Link: InfoSec Handlers Diary Blog - SANS Internet Storm Center