Suspicious Redirection to Local Admin Share

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

Detects suspicious output redirection to the local administrative share (ADMIN$). This technique is often used by malicious scripts or hack tools to stage or exfiltrate data by writing it to a location accessible via the network, specifically targeting the ADMIN$ share on localhost or 127.0.0.1.