DragonForce-style rapid SMB share enumeration across multiple hosts
Detects a host initiating rapid sequential SMB tree connections to more than 10 distinct remote hosts within a 5-minute window. This behavior is indicative of network reconnaissance, specifically the enumeration of accessible SMB shares, which is a common precursor to lateral movement and large-scale ransomware encryption activity as observed in DragonForce-related incidents.
YARA-L
