C2Looper v2 rapid multi-command recon chain
Detects a sequence of common discovery commands (ipconfig, whoami, nltest, net group, wmic) executed within a short timeframe (60 seconds) by the same process. This activity is indicative of an adversary performing internal reconnaissance to understand the environment, network, and user privileges.
Microsoft Sentinel (KQL)
