Web shell write plus credential dumping and security sensor enumeration on same
Detects a sequence of suspicious behaviors on a single device within a 4-hour window: web shell file creation by a web server process, subsequent credential extraction or dumping tooling execution (such as accessing LSASS, NTDS, or SAM), and enumeration of installed security software or endpoint sensors.
Microsoft Sentinel (KQL)
