On Detection, Information Security, Research, Detection Engineering.
or system calls (syscalls). With that in mind, it is worth understanding the entire function call stack to understand what exactly happens after netapi32!NetSessionEnum is called. To figure this out, we can open netapi32.dll in a disassembler like IDA Pro. netapi32!NetSessionEnum After loading