An operation sequence involving system information collection, network segment scanning, and credential file reading appearing within a short period of time should trigger a high-priority alert.