SafePay network share and host discovery tooling (ShareFinder, SharpShares, nets
Detects the correlation of two or more distinct discovery tools or artifacts (such as SharpShares, NetScan, NetExec, ShareFinder, and specific nltest.exe domain trust commands) executed on the same device within a one-hour window.
Microsoft Sentinel (KQL)
