Suspicious Command Line Activity - Checksum/Hash Utilities

Ankit Mehta@Secvyn

•updated Jun 13, 2026•0•0•2

Detects suspicious command-line activity involving utilities that contain 'checksum' or 'hash' in their command line, potentially indicating file integrity checks, malware analysis evasion, or credential dumping attempts. The rule triggers if five or more such commands are executed within an hour by the same account on the same computer.