Cleartext Credential File Search/Access on Admin Workstation
Detects access to files containing cleartext credentials on an administrative workstation, followed by their use to authenticate to a sensitive business system — the initial-access path CISA's red team used against SBS 1.
Microsoft Sentinel (KQL)
