Suspicious Network Scan Loop via Command Line

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•18

This rule detects suspicious network scanning activity by identifying command-line executions that combine looping constructs ('for', 'foreach') with network discovery tools ('nslookup', 'ping'). This pattern is often used by adversaries to enumerate systems on a network for lateral movement or further reconnaissance.