Shares mapped via "net.exe"

Anandakumar Sivanandam@Andywk

•updated Nov 13, 2025•21•0•181

This use case detects when shares are mapped via "net.exe" within command line. More specifically, hidden administrative shares that can be mapped and used to remote file copy malicious files and/or executables.