Hi
Is there a query that can be used to search for discovery scanning? I know I can use the Endpoint Activity “Process Start Events” to search for certain scanning programs like “Lansweeper.exe”,“AngryIPscanner.exe”, etc but is there a way to leverage Sysmon logs to actually find endpoint scanning from a NONE managed asset?
TIA and hope that makes sense.