SMB share enumeration (NetShareEnum) preceding bulk remote share writes

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•4

Detects the SMB share discovery pattern associated with the DragonForce ransomware, where the system enumerates network shares (excluding ADMIN$) followed by unauthorized bulk write operations to these shares, indicating potential lateral movement and file encryption.