Network Session Enumeration via cmd.exe (EtherRAT)
Identifies anomalous enumeration of local network sessions via cmd.exe using the 'net session' command, a technique observed during EtherRAT's post-exploitation phase for lateral movement reconnaissance.
Microsoft Sentinel (KQL)
