Users creating Network Shares
The Query shows all new created Network Shares.
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName="NetShareAdd"
| wildcard(field=UserName, pattern=?UserName, ignoreCase=true)
| wildcard(field=ComputerName, pattern=?ComputerName, ignoreCase=true)
| groupBy([ComputerName, UserName, ShareName, SharePath, ShareData, @timestamp])users_creating_network_shares.yml
CrowdStrike
Hunting
Endpoint
Insight
2025-08-26
2025-11-24
