Malware Binary Moved to New Location via SMB

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to move executable files (.exe) over SMB (Server Message Block) by looking for the 'MoveFile' string and the '.exe' extension in network traffic on port 445. This activity could indicate malware being relocated on a network share.