Admin share mounted via net use to C$ with explicit credentials

Detects the use of the Windows 'net use' utility to mount a C$ administrative share using explicit user credentials. This behavior is commonly associated with lateral movement techniques where an adversary attempts to connect to a remote system share to gain access, transfer files, or execute binaries.