Mass File Access Across User Profiles via Compromised DFS Root Share
Detects bulk file enumeration/access across multiple users' virtual desktop profile shares via a compromised root DFS drive, which CISA's red team used to read local files of all users regardless of active session.
Microsoft Sentinel (KQL)
