Akira/BumbleBee - Invoke-ShareFinder or SoftPerfect Network Scanner Post-Compromise

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

This rule detects the execution of PowerShell commands related to network share discovery (Invoke-ShareFinder, Get-NetShare) and the execution of the SoftPerfect Network Scanner (netscan.exe/netscan64.exe), which are techniques commonly used by adversaries for internal network reconnaissance.