Gentlemen Ransomware Enables Discovery Services and Firewall Rules

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•0•0•1

Detects the execution of 'netsh.exe', 'sc.exe', or 'powershell.exe' with command-line arguments indicative of enabling network discovery, file and printer sharing, or modifying firewall rules to allow inbound connections. This behavior is associated with the Gentlemen ransomware for propagation.