SOCKS5 proxy masquerading as smbd -D for internal pivoting (Velvet Ant)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects instances of the 'smbd' process executing from non-standard locations or initiating network connections on ports other than the default SMB ports (139, 445), which may indicate a rogue service, masquerading, or network pivoting activity.