SSL-VPN promiscuous-mode/traffic-control abuse outside maintenance windows
Detects SSL-VPN traffic-control/promiscuous-mode changes triggered by unexpected or unsigned processes outside approved maintenance windows, consistent with Gunra's interception of VDI authentication traffic.
Microsoft Sentinel (KQL)
