Suspected Reconnaissance and Privilege Escalation Chain

Ankit Mehta@Secvyn

•updated Jun 25, 2026•0•0•2

This rule detects a potential privilege escalation chain by identifying a sequence of common discovery commands (net.exe, whoami.exe, ipconfig.exe) followed within 30 minutes by process execution involving keywords related to administrative accounts or systems (admin, administrator, system) on the same host.