Suspicious Network Configuration Discovery Commands
This rule detects the execution of common Windows command-line utilities used for system network configuration discovery. Adversaries often use these commands to gather information about the network environment, including IP addresses, network interfaces, ARP tables, NetBIOS information, and routing tables. The specific commands monitored are 'ipconfig /all', 'netsh interface show interface', 'arp -a', 'nbtstat -n', 'net config', and 'route print'.
Sigma
