AD service/MySQL credential and computer object recon via LOTL tooling

Ankit Mehta@Secvyn

•updated 28 days ago•0•0•1

Detects the execution of common system administration tools (cmd, powershell, net, nltest, etc.) used to perform environment discovery or credential enumeration, specifically when targeting Domain Controllers, Active Directory objects, database credentials, or sensitive configuration files.