SMB Create Remote File on Admin Share by Non-System Account

SigmaHQ Detections@sigmaHQ

•updated Oct 17, 2025•0•24

This rule detects attempts by non-system accounts to create or write to files on administrative shares (e.g., C$) via Server Message Block (SMB). This activity is often associated with lateral movement or persistence techniques where attackers drop tools or establish footholds on remote systems.