NetExec/NXC Lateral Movement and Credential Spray Detection
Detects the execution of NetExec (formerly CrackMapExec) binaries, associated named pipe creation, and suspicious bursts of authentication activity indicating potential lateral movement or password spraying attacks.
Splunk (SPL)
