Salt Typhoon TernDoor/PeerTime - Workstation Lateral Movement to Mgmt Ports
Detects workstations establishing multiple connections to non-standard, internal management ports (SSH, Telnet, SNMP). This behavior is often associated with lateral movement or unauthorized network scanning using tools that leverage management protocols.
Microsoft Sentinel (KQL)
