Suspicious Redirection to Local Admin Share — Detection Rule

Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or hacktool stagers

Read the full analysis on IntelFusions