MSI-spawned scripting process performing LDAP enumeration then external connection
Detects msiexec.exe spawning scripting or programming engines (such as PowerShell or Python) that perform LDAP directory searches and establish outbound external network connections within a specific time window.
Microsoft Sentinel (KQL)
