Suspicious Get-SmbShare Cmdlet Usage

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

This rule detects the use of the PowerShell cmdlet 'Get-SmbShare', which adversaries may use to discover shared folders and drives on remote systems. This information can be leveraged for data collection or lateral movement within a network.