Suspicious Host Enumeration Command Sequence
Detects the execution of sequences of built-in administrative command-line tools often used by adversaries for system discovery and reconnaissance. The rule triggers on specific patterns of commands (e.g., WMI queries, system information gathering, or comprehensive user enumeration) that are frequently combined by attackers to understand the target environment.
CQL
