Administrative Share Mounted via net use with Explicit Credentials (ADMIN$/C$)
Detects the execution of 'net use' commands targeting administrative shares (C$ or ADMIN$) on Windows systems. This behavior is frequently associated with lateral movement, where an adversary attempts to connect to remote file shares using administrative credentials to move files or execute malicious payloads.
Cortex XDR
