DragonForce-style TCP/445 connect sweep for SMB share enumeration (GetIpNetTable/NetShareEnum lateral targeting)

Arnold Chan@slaz

•updated Sep 9, 2026•0•0•1

Detects high-frequency TCP/445 connection attempts (a 'connect sweep') characteristic of automated SMB share enumeration, which is commonly used for lateral movement reconnaissance. The rule triggers when a threshold of 40 connection requests occurs from a single source within a 30-second window, specifically targeting SMB-related lateral movement behaviors.