System Information Discovery via Scripting Host or Remote Shell

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•1

Detects the execution of common Windows system information discovery utilities (systeminfo, hostname, ver) when spawned by command interpreters or scripting engines, which is a common behavior in post-exploitation reconnaissance.