NTLM Coercion Detection via Comp.exe
This rule detects the execution of 'comp.exe' with any command-line arguments. This activity can be indicative of NTLM coercion attempts, where an attacker forces a target machine to authenticate to a malicious server to capture and potentially crack the NTLM hash.
Microsoft Sentinel (KQL)
