NetScan Shares Write Access Check

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the use of NetScan's 'Check for write access' feature by monitoring the write access check of a 'delete.me' file on network shares. When NetScan is run with the 'Check for write access' option enabled, it creates and then deletes a 'delete.me' file on discovered network shares to test write permissions.

2025-02-24 00:00:00

None

4bcc721e-c5f4-47a3-ba56-b6019406aaa7

attack.discovery attack.t1135

Nextron Sigma feed only (private)