Alert T1021.002

T1021.002: This behavior may indicate attempt to use valid credentials to interact with a remote network share using Server Message Block (SMB).

Recommended actions:
Disconnect the HOST from the network.
Investigate incident on the host and analyze the script
Investigate with the user