Userdomain Variable Enumeration via Echo Command
Detects the execution of the 'echo' command with the '%userdomain%' environment variable. This activity can be used by adversaries to enumerate the domain a user is associated with, which is a common discovery technique.
Sigma
