Detection of Newly Created Machine Accounts Exposing LDAP and SMB Services
This query is trying to identify cases where a newly created machine account may correspond to a device that quickly begins exposing domain-controller-like services, especially LDAP and SMB.
Microsoft Sentinel (KQL)
