StrikeShark FScan and net.exe Domain/Group Enumeration Recon

Ibrahim Saud@tektrix

•updated Jun 28, 2026•1•0•4

This rule monitors for the execution of common reconnaissance, enumeration, and scanning tools often used in post-exploitation scenarios. It detects the usage of scanners like fscan, network discovery utilities like net.exe, nltest, dsquery, and credential/directory enumeration tools like SharpHound. These tools are commonly used for domain discovery, network mapping, and collecting information for lateral movement or privilege escalation.