SMB Create Remote File Admin Share — Detection Rule
Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).
Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).