Gentlemen Creates or Re-enables Administrative Shares

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•0•0•4

Detects creation or restoration of ADMIN$, C$, or custom hidden shares used for remote ransomware deployment. This rule specifically looks for `net.exe`, `powershell.exe`, or `cmd.exe` executing commands that create or modify SMB shares, targeting administrative shares like ADMIN$, C$, or any share ending with a dollar sign ($).