StrikeShark Searchall/FScan Domain Enumeration and Recon Activity

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects the execution of common reconnaissance and discovery tools on Windows systems, including network and domain trust enumeration tools, and system information utilities. This rule alerts on suspicious usage of binaries like fscan, SharpGPOAbuse, and administrative commands (net, nltest, whoami, ipconfig) used to gather information about the environment, domain trusts, or local system configuration.