Windows Admin Share Connection via 'net use' Command from Domain Computer
This rule detects the use of 'net use' commands to connect to Windows administrative shares (C$, ADMIN$, IPC$) from a principal IP address associated with a Windows asset entity. It correlates process launch events with asset entity data, specifically looking for Windows machines within the 'Domain Computers' group. This activity can indicate lateral movement or remote access by an adversary.
YARA-L
