Windows Admin Share Mount Via Net.EXE — Detection Rule

Detects when an admin share is mounted using net.exe

Read the full analysis on IntelFusions