Process Spawns Multiple Recon Processes
Detects anomalous host reconnaissance patterns characterized by the execution of four or more distinct discovery tools (e.g., systeminfo, ipconfig, net, whoami) by a single process within a 24-hour period. This behavior is indicative of an adversary performing environment discovery following initial access or privilege escalation. This will not catch discovery commands that are run in "memory", only those that spawn an additional executable like whoami.
Cortex XDR
