StrikeShark Post-Compromise Recon Burst: 4+ Discovery Tools in 120s Same Parent

Ibrahim Saud@tektrix

•updated Jun 28, 2026•1•0•5

Detects a burst of reconnaissance activity typical of the StrikeShark toolkit, where an adversary executes four or more distinct system enumeration commands (systeminfo, whoami, ipconfig, net view, hostname, nltest, arp) from the same host and parent process within a 120-second window. The rule excludes common system management process lineages to reduce noise.