Successful VPN Session Followed by Active Directory Discovery Commands

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•10•0•17

Correlates a successful Fortinet SSL VPN session with nltest, net, Get-AD*, AdFind, ldapsearch, WinRS, or WMIC discovery commands for the same account within forty-five minutes. This behavior can indicate an attacker establishing initial access via VPN and then performing internal reconnaissance.