Executable Drop to Shared Network Folder

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects attempts to drop executable files (.exe) into shared network folders (specifically those containing '\share\') over SMB (Server Message Block) protocol. This activity is indicative of an attacker attempting to move tools or malware laterally within a network.