Operation Poisson System and File Discovery via Enumeration Tools

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•4

This rule detects the execution of multiple system and file discovery commands within a short timeframe, which can be indicative of an adversary performing reconnaissance. The rule specifically looks for common Windows commands like 'systeminfo', 'whoami', 'ipconfig', 'net', 'tasklist', 'net user', 'net localgroup', 'wmic os get', 'wmic product get name', 'dir /s', 'Get-ChildItem', and 'Get-Process' executed via cmd.exe, powershell.exe, or wmic.exe. It triggers if at least 3 commands are executed or if at least 2 distinct tools are used within an hour.