Domain Account Used for SMB External Access
Detects domain account authentication anomalies over SMB from external sources
Microsoft Sentinel (KQL)

Detects domain account authentication anomalies over SMB from external sources

Already have an account?