Script File Planted on Shared Drive for Lateral Movement

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects the planting of script files, specifically PowerShell scripts (.ps1), on shared network drives. It looks for SMB traffic directed to a server on port 445 (SMB) that contains both the string ".ps1" (case-insensitive) and the string "\\share\\" (case-insensitive). This activity is indicative of an attacker staging scripts on a network share for potential lateral movement within a network.