Suspicious Script or Executable Execution from NETLOGON Share
Detects the execution of an executable or script file from the NETLOGON share. This behavior was observed during the deployment of the Obscura ransomware and is a strong indicator of lateral movement or malicious deployment via Group Policy.
Sigma
