CISA Report - Credential Access and Reconnaissance Commands
This rule detects suspicious command-line activity indicative of credential access or reconnaissance, as outlined in a CISA 'Living off the Land' report. Specifically, it looks for commands that attempt to list SSH known hosts, access Firefox profiles, execute Mimikatz, query OpenSSH or RealVNC registry keys, or save SAM/SYSTEM registry hives. While individual commands might be benign, their combined presence or repeated execution could signal malicious intent.
YARA-L
