Suspicious Access Attempt to the cert Windows Share (Possible Certipy Activity)

NinnesOtu@NinnesOtu

•updated Jun 25, 2025•22•12•216

This rule detects attempts to access the Windows share IPC with the specific target name "cert," which could indicate unauthorized certificate requests. This behavior has been linked to tools such as Certipy.