Post-VPN AD/SMB discovery tooling: NetExec, Kerbrute, Impacket, noPac
Detects the execution of two or more distinct Active Directory discovery, credential extraction, or coercion tools (such as NetExec, Kerbrute, noPac, PetitPotam, SoftPerfect Network Scanner, or Impacket scripts) on the same device within a 1-hour window.
Microsoft Sentinel (KQL)
