VDI Client Followed by Network Share Discovery

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•0•0•2

Correlates Windows 365 or Citrix client execution with network share discovery commands by the same account on the same device within thirty minutes. This rule detects potential post-compromise activity where an attacker might be using a VDI session to enumerate network shares.