SMB Create Remote File Admin Share

심각도 높음 Sigma 탐지 룰. Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).

작성자: Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research) · 원본 라이선스: DRL 1.1 · SigmaHQ 원본