SMB Create Remote File Admin Share

SigmaHQ Detections@sigmaHQ

•updated Oct 17, 2025•0•0•0

Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).