OpenConnect VPN client use followed by internal SMB/AD enumeration on same device
Detects the execution of OpenConnect VPN clients on non-sanctioned devices followed within a 4-hour window by high-volume internal network connections across multiple ports indicative of network service discovery or pivoting activity.
Microsoft Sentinel (KQL)
