UNC3944 Recon Tool Execution Detection

Aaron Mog@AaronMogS2S

•updated May 7, 2025•4•4•130

Detects the execution of Active Directory reconnaissance tools (ADRecon, ADExplorer, SharpHound) commonly used by UNC3944 (Scattered Spider) actors during internal reconnaissance phases.