Rule Info
Name
Expand File Over Admin Share
Author
MalGamy (Nextron Systems)
Description
Detects the use of expand command to extract files from located on an administrative share, potentially used for lateral movement or staging files.
Date
2024-11-10 00:00:00
Modified
2026-05-09 00:00:00
Id
5f6e3b6c-9ab2-4b7e-b5bc-13a9e02753d4
Tags
attack.command-and-control attack.exfiltration attack.t1071
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR