Python implant spawning msiexec followed by LDAP burst from same device
Detects a Python process spawning msiexec.exe followed by a high volume of LDAP connections (burst) from the same device within a 30-minute window, potentially indicating post-exploitation activity such as domain enumeration.
Microsoft Sentinel (KQL)
