NTLM Credential Stealing via MpCmdRun
Detects suspicious usage of MpCmdRun.exe, the Microsoft Defender command-line utility, to potentially steal NTLM credentials. This rule specifically looks for MpCmdRun.exe being executed with parameters related to scanning or exclusion checking, combined with attempts to access remote UNC paths (\\). This behavior can indicate an adversary attempting to force NTLM authentication to a controlled server to capture hashes.
Microsoft Sentinel (KQL)
