Living-off-the-Land (LotL) Activity
This detection identifies a sequence of command-line activities consistent with techniques used by state-sponsored actors. The rule looks for the execution of multiple native Windows reconnaissance or credential dumping commands from a single host and user, which is a common pattern for actors performing hands-on-keyboard operations after gaining initial access.
Sigma
