Fanout Lateral Movement Script Created in a Temporary Directory
Detects a shell script containing 'fanout' in its name, created or modified in common temporary directories like /tmp or /var/tmp, matching a reported propagation workflow. This activity is indicative of lateral movement attempts.
Microsoft Sentinel (KQL)
