Canary Network Share Reconnaissance

Aaron Beardslee@abeardslee

•updated Feb 2, 2026•1•0•40

Detects access to hidden or decoy network shares that are not used by legitimate processes. This activity is indicative of network reconnaissance and lateral movement attempts. Walkthrough of Canary Shares can be found here: https://github.com/fluffybunnies-h4x/CyberDeception/blob/main/README.md#canary-shares