Windows Domain Enumeration via Net Utility
Detects the use of common 'net' utility commands used by attackers to enumerate local and domain users and groups, such as domain admins or Exchange-specific security groups. This activity is a common indicator of reconnaissance during the post-exploitation phase.
Microsoft Sentinel (KQL)
