Network Discovery Commands Executed for Environment Mapping

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•7

Detects rapid execution of multiple network reconnaissance commands on a single host. Adversaries often use these built-in utilities (e.g., ipconfig, net, arp) to map an environment's network configuration, users, shares, and service structure after initial compromise to inform subsequent lateral movement.