n-ten.dll loaded followed by internal port scan and SMB enumeration
This rule detects a suspicious sequence of events where a device loads a specific DLL named 'n-ten.dll' and subsequently engages in high-volume network connection activity within a short time window. The rule alerts on endpoints that perform network scanning (defined by a threshold of distinct remote IPs or ports) shortly after the specified module load, which is a common behavior pattern for malicious payloads or backdoors initiating internal reconnaissance or lateral movement.
Microsoft Sentinel (KQL)
