SparroWocky-style host recon: computer name, user/domain, OS version

Ankit Mehta@Secvyn

•updated Sep 17, 2026•0•0•2

Detects a cluster of host enumeration and system discovery commands (such as whoami, hostname, systeminfo, and network config queries) executed by the same process account within a short window, which is often indicative of post-exploitation reconnaissance.