Detects the use of Advanced Port Scanner.

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.

Detects execution of Net.exe, whether suspicious or benign.

Detects typical Dridex process patterns

Detects automated lateral movement by Turla group