CHOSEN BRICK process spawns system/process enumeration commands
Detects reconnaissance and situational-awareness collection commands (e.g., tasklist, systeminfo, wmic, powershell) executed by processes matching suspected persistence artifacts associated with known malicious activity (specifically referencing potential Telegram C2 tasking). The rule monitors common discovery utilities spawned by suspicious process names or paths.
Microsoft Sentinel (KQL)
