Cavern Manticore lateral movement via lazily-resolved WNetAddConnection2 mpr.dll P/Invoke

Ethan Andrews@eandrews

•updated Jul 6, 2026•1•0•4

Detects mpr.dll loaded by non-standard processes followed by an SMB (port 445) connection from the same process, consistent with Cavern Manticore's WNetAddConnection2 routine that lazily resolves the API via P/Invoke (bypassing the static import table) and marshals stolen credentials to authenticate to remote network resources.