SMB credential spraying via mpr.dll WNetAddConnection2 rapid connect/disconnect cycles

Ethan Andrews@eandrews

•updated Jul 6, 2026•4•0•4

Detects rapid SMB (port 445) connect/disconnect patterns originating from processes that have loaded mpr.dll. This behavior is indicative of credential spraying tools, such as the Cavern Manticore NetUseBrute module, which utilizes WNetAddConnection2 and WNetCancelConnection2 to cycle through credentials against multiple endpoints.