Do you build custom detections with Microsoft Defender for Endpoint?
I was reading about a recent PaperCut exploit where suspicious activity was identified through commands such as whoami and local administrator-group enumeration. I tested several unusual commands in…