Transferring Files with Credential Data via Network Shares - Zeek — Detection Rule

Transferring files with well-known filenames (sensitive files with credential data) using network shares

Read the full analysis on IntelFusions