DragonForce-style TCP/445 SMB share enumeration sweep

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•4

This rule identifies potential network scanning or propagation activity by detecting a single host initiating SMB (TCP 445) connections to a high number (more than 20) of unique destination IP addresses within a given timeframe. This behavior is often indicative of internal reconnaissance, lateral movement, or worm-like propagation.