Win Susp Computer Name Containing Samtheadmin — Detection Rule

Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool

Read the full analysis on IntelFusions