Network Configuration Discovery via ipconfig/arp/route from Shell Parent (T1016)
Detects execution of common Windows network configuration utilities (ipconfig, arp, route) by known command-line and script interpreters. This pattern is indicative of an attacker performing reconnaissance to gather information about the host's network settings, interfaces, and connectivity.
SentinelOne
