Network Session Enumeration via cmd.exe (EtherRAT)

nomit vyas@xoxo

•updated Jun 24, 2026•10•0•17

Identifies anomalous enumeration of local network sessions via cmd.exe using the 'net session' command, a technique observed during EtherRAT's post-exploitation phase for lateral movement reconnaissance. The rule specifically looks for the command line arguments '/d /s /c' in conjunction with 'net session'.