NightLedger collection of NetSetup.log via unusual process access
Detects unauthorized access or staging operations on the C:\Windows\debug\NetSetup.log file. This activity is often associated with the NightLedger tool, which collects this diagnostic log alongside process listings for potential exfiltration. The rule filters out legitimate system processes that typically interact with this file during domain or workgroup join operations.
Microsoft Sentinel (KQL)
