Suspicious Script and Utility Execution

Shadows VMB@Vemorian_Mort

•updated Aug 3, 2026•3•0•4

This rule detects the execution of common command-line interpreters and utility tools frequently abused by attackers for reconnaissance, execution, and post-exploitation activities. Monitored binaries include script interpreters (python.exe, powershell.exe, pwsh.exe, bash.exe, sh.exe) and command-line utilities (cat, grep, find).