Recursive File & Directory Enumeration via dir, Get-ChildItem, find, or ls -R (T1083)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

Detects recursive file and directory discovery activity performed by common command-line utilities (dir, gci, find, ls) when initiated by suspicious parent processes such as interpreters (python, node, wscript) or shells, excluding processes signed by known trusted publishers.