High Volume Network Share Access

Ankit Mehta@Secvyn

•updated Apr 17, 2026•14•0•665

This rule detects an unusually high volume of network share access attempts from a single IP address and account within a short time frame (5 minutes). This could indicate an adversary attempting to discover or access network shares, potentially for data exfiltration or lateral movement.