Akira: SoftPerfect Network Scanner and Invoke-ShareFinder SMB Enumeration
Detects the execution of unauthorized network scanning tools (e.g., netscan.exe, n.exe), usage of reconnaissance PowerShell scripts like Invoke-ShareFinder, or the creation of common reconnaissance artifacts such as 'delete.me' or 'shares.txt'. The rule monitors Sysmon process creation, network connection events, and file creation events to identify activities consistent with internal network discovery and lateral movement preparation.
Splunk (SPL)
