High Volume Admin Share Activity

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•2

This rule detects a high volume of activity (10 or more events within an hour) to Windows administrative shares (C$, IPC$, ADMIN$) from a single source IP address. This behavior can indicate lateral movement, data exfiltration, or other malicious activity using legitimate administrative functions.