High Volume Network Share Access
This rule detects an unusually high volume of network share access attempts from a single IP address and account within a short time frame (5 minutes). This could indicate an adversary attempting to discover or access network shares, potentially for data exfiltration or lateral movement.
Microsoft Sentinel (KQL)
