Windows Admin Share Mount Via Net.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

This rule detects the use of 'net.exe' or 'net1.exe' with the 'use' command to mount an administrative share (e.g., C$, ADMIN$) on a Windows system. This activity is often associated with lateral movement by adversaries.