XCSSET uname/whoami Fingerprinting Chained from /tmp Bash Dropper
Detects uname/whoami host-fingerprinting commands chained as child processes of a bash process spawned from a suspicious /tmp-staged script, matching XCSSET's reconnaissance-and-exfiltration pattern.
Microsoft Sentinel (KQL)
