The Gentlemen - SMB Malware Spread via NetExec
Detects NetExec SMB-based malware deployment across network ranges. The Gentlemen use nxc smb with atexec/smbexec to disable Defender, mount shares via net use, and execute ransomware (cerv.exe) across entire subnets. Also detects creation of open shares with Everyone:FULL access.
YARA-L
