Anomalous system network connection discovery

Duo Tech@duotech

•updated Aug 11, 2026•0•0•5

Detects repeated netstat.exe execution or net use enumeration across multiple distinct hosts in a short window, excluding known network-monitoring (NPM) tools and helpdesk remote-support sessions.