Prohibited Software On Endpoint

Unusually Long Command Line - MLTK

Suspicious File Write

Web Servers Executing Suspicious Processes

System Information Discovery

Detect Mimikatz Via PowerShell And EventCode 4703

LSASS Memory