Multiple Network Discovery Commands in Short Span
This rule detects the execution of multiple common network discovery commands within a short time frame. This behavior can indicate reconnaissance activities aimed at understanding network topology, identifying active hosts, and discovering network services.
Sigma
