Nessus Authenticated Scan on AAD-Joined Device

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•2

Detects successful network or explicit credential logons (4624/4648) on Windows workstations where the username or workstation name contains keywords associated with Tenable Nessus scanning activity, indicating an authenticated vulnerability scan.