Detection of 'net use' for Windows Administrative Shares
This rule detects the use of the 'net use' command to connect to Windows administrative shares (C$, ADMIN$, IPC$). Adversaries often use these shares for lateral movement, file transfer, and remote execution within a network. The rule specifically looks for command-line executions containing 'net use' followed by one of the common administrative share names, case-insensitively.
YARA-L
