T1080 – Taint Shared Content - Unknown executable on NETLOGON or SYSVOL share
Identifies an unknown binary being access in some way (see AccessMask below) on the NETLOGON or SYSVOL share of a DC. Ransomware operators often stage ransomware executables here before deploying ransomware to an organization. While this query currently hits on ALL AccessMask values, you may want to tune out the less critical ones near the bottom of the list. Of course, Read & Execute is the most concerning, though you may want visibility into others depending on your environment. As always, test in your environment for known behavior and tune accordingly before operationalizing.
Microsoft Sentinel (KQL)
