Frequent Inventory Checks by System Utilities

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•5

This rule detects an unusual frequency of inventory-related commands being executed on a device within a one-hour window. Specifically, it looks for `tasklist.exe`, `wmic.exe`, or `Get-HotFix` being run 5 or more times in an hour. This behavior can indicate an adversary performing system information discovery.