DragonForce-style TCP/445 SMB share-target scanning

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•0

Detects outbound network connections over TCP port 445 directed toward common internal IP address ranges (RFC 1918) by processes other than standard system binaries. This pattern is characteristic of SMB network scanning or lateral movement activities, such as those used by the DragonForce locker ransomware to discover target hosts within a network.