Suspicious Discovery Tool Execution Burst

Kaung Khant Ko@kaungkhantko

•updated Jun 25, 2026•0•0•1

Detects post-compromise reconnaissance activity characterized by a rapid burst of native Windows tool executions (whoami, net, ipconfig, systeminfo, nltest, wmic) or PowerShell commands used for discovery. The rule triggers when a threshold of 3 distinct reconnaissance activities is met within a 30-minute window on a single device, helping to identify potential lateral movement or internal network mapping by an adversary.