PowerShell IP octet splitting for subnet calculation (DNS recon)
Detects PowerShell script block execution containing patterns associated with network discovery, specifically splitting IP strings and calculating /24 subnets, often indicative of host or network reconnaissance.
Microsoft Sentinel (KQL)
