Suspicious PowerShell Get-SmbShare Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

This rule detects the execution of the PowerShell cmdlet `Get-SmbShare`. Adversaries often use this cmdlet to discover shared folders and drives on remote systems, which can help them identify valuable information for collection or potential targets for lateral movement. This activity is a common precursor to further reconnaissance and exploitation within a network.