Postvpn Discovery Or Lateral Movement Via Commandline Tools
This rule detects post-VPN discovery or lateral movement activities by monitoring network connections initiated by specific command-line tools. It targets the use of utilities like PowerShell, cmd, net, nltest, adfind, ldapsearch, wmic, or winrs to interact with many internal systems, which could indicate an attacker performing reconnaissance or moving laterally within the network after gaining initial access, potentially via a compromised VPN.
YARA-L
