DeviceManager RAT host profiling recon - correlated multi-indicator detection (MachineGuid, SID, AV enumeration)
Detects correlated host-profiling reconnaissance by the DeviceManager RAT: three or more distinct indicators (MachineGuid, volume serial, user SID, AV product enumeration, domain/workgroup enumeration) executed within a 15-minute window from the same python.exe/pythonw.exe parent process.
Microsoft Sentinel (KQL)
