Unusual SMB Executable File Transfer

$source transferred an unusually high number of executable files to multiple devices. This behavior indicates that an attacker might have compromised this device and is attempting to move laterally across the network.

After an attacker compromises a workstation, the attacker searches for new targets on the network. Ideally, the compromised workstation has credentials that provide the attacker with administrative access to a new target. With administrative access, the attacker can transfer an executable file to a default file share (such as ADMIN$ or C$) on the target. After the malicious payload from the file runs (through the actions of the attacker or the victim), the attacker can move laterally to the newly compromised device to conduct more attacks.