Writing to Local Admin Share on Loopback Address
This rule detects attempts to write files to the local administrative share (ADMIN$) on a Windows system, specifically when the target is the local machine (127.0.0.0/8 IP range). Adversaries often use administrative shares for lateral movement, persistence, or to stage tools and data during post-exploitation activities. The detection logic looks for file events where the target filename contains both a local loopback IP address (e.g., \\127.0.0.1) and the administrative share name 'ADMIN$'.
Sigma
