Remote Network Connection Table Enumeration

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects attempts to enumerate network connection tables remotely over SMB (port 445). It specifically looks for the string "NetConnectionEnum" in TCP traffic directed to port 445 on the home network, indicating a potential network discovery activity.