Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

DragonForce – Rapid Multi-Tool Network/AD Reconnaissance

Dragonforce Discovery Sentinel
MITRE ATT&CK
Remote System Discovery
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (dragonforce)
What This Detects
DragonForce affiliates typically run Advanced IP Scanner, PingCastle and SoftPerfect NetScan back-to-back on the same host during the discovery phase. Two or more of these tools from one account in a short window is a strong pre-encryption signal.
Query
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName in~ ("advanced_ip_scanner.exe","pingcastle.exe","netscan.exe")
| summarize ToolsSeen = make_set(FileName), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, AccountName
| where array_length(ToolsSeen) >= 2

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.