Remote System Discovery Commands

process where host.os.type == "windows" and event.type == "start" and
  ((process.name : "nbtstat.exe" and process.args : ("-n", "-s")) or
  (process.name : "arp.exe" and process.args : "-a") or
  (process.name : "nltest.exe" and process.args : ("/dclist", "/dsgetdc")) or
  (process.name : "nslookup.exe" and process.args : "*_ldap._tcp.dc.*") or
  (process.name: ("dsquery.exe", "dsget.exe") and process.args: "subnet") or
  ((((process.name : "net.exe" or process.pe.original_file_name == "net.exe") or
    ((process.name : "net1.exe" or process.pe.original_file_name == "net1.exe") and not 
       process.parent.name : "net.exe")) and 
       process.args : "group" and process.args : "/domain" and not process.args : "/add"))) and
  not
  (
    (
      process.name : "arp.exe" and
      process.parent.executable : (
        "?:\\ProgramData\\CentraStage\\AEMAgent\\AEMAgent.exe",
        "?:\\Program Files (x86)\\Citrix\\Workspace Environment Management Agent\\Citrix.Wem.Agent.Service.exe",
        "?:\\Program Files (x86)\\Lansweeper\\Service\\LansweeperService.exe"
      )
    )
  )