Suspicious NetScan Network Share Artifact
This rule leverages Windows Security logs to detect potential lateral movement or staging activity involving a known artifact used by NetScan, a portable network scanning tool. Specifically, it monitors for attempts to write or delete files like `delete.me` across network shares.
Sigma
