TukTuk C2 Shell Mode remote command execution (recon commands)

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•4

Detects rapid execution of multiple discovery-related commands (whoami, tasklist, ipconfig, netstat, systeminfo) by common Windows host processes within a 15-minute window. This behavior often indicates an adversary performing reconnaissance after gaining an initial foothold.