System Recon Commands in Rapid Sequence or from Suspicious Parent (T1033/T1082)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

This rule detects suspicious reconnaissance patterns on Windows endpoints. It monitors for the execution of common discovery utilities (whoami, hostname, ipconfig, systeminfo) when they are either executed in a rapid sequence (more than 2 distinct tools within 5 minutes) or when they are launched from known suspicious parent processes commonly used for script execution and evasion (e.g., PowerShell, WScript, MSHTA, etc.).