Suspicious Access to Sensitive File Extensions on Network Share

SigmaHQ Detections@sigmaHQ

•updated Oct 17, 2025•1•0•46

Detects access to known sensitive file extensions on network shares. This can indicate an adversary attempting to collect sensitive data such as backups, memory dumps, Kerberos tickets, or various email/messaging data files.