Post-Exploitation Host Recon Burst (id, uname -a, hostname, ifconfig/ip)

Duo Tech@duotech

•updated Jul 8, 2026•1•0•2

This rule detects potential adversary reconnaissance behavior by identifying hosts executing a combination of common system and network enumeration commands (id, uname, hostname, ifconfig/ip) in short succession. Detecting multiple distinct reconnaissance commands from a single process context may indicate an interactive shell session being used to gather information about the environment.