Windows Cmdline Tool Execution From Non-Shell Process

The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`, `net1.exe`, or similar tools are executed by a non-standard shell parent process, excluding CMD, PowerShell, Explorer, or `net.exe`. This detection leverages Endpoint Detection and Response (EDR) telemetry to monitor process creation events. Such behavior is significant as it may indicate adversaries using injected processes to perform system discovery, a tactic observed in FIN7's JSSLoader. If confirmed malicious, this activity could allow attackers to gather critical host information, aiding in further exploitation or lateral movement within the network.