Dynamic GetProcAddress resolution of WNetAddConnection2/NetShareEnum/NetUserEnum
This rule monitors for processes dynamically resolving sensitive Windows networking API functions (WNetAddConnection2, NetShareEnum, NetUserEnum) at runtime using GetProcAddress. This technique is often used by malware to conceal its reliance on legitimate system APIs to perform discovery operations, such as enumerating network shares or users, while evading static analysis.
Microsoft Sentinel (KQL)
