Repeated Command Line Execution with 'version' and 'control' Keywords

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects repeated execution of commands containing both 'version' and 'control' keywords within the command line. It specifically looks for at least 5 such executions within a one-hour window on the same computer by the same account. This pattern could indicate an adversary attempting to enumerate system or software versions, or interact with version control systems, potentially as part of reconnaissance or privilege escalation.