JDY/NUKESPED System and Network Discovery on Compromised Edge Devices

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects potentially malicious reconnaissance and execution activity. On Linux, it monitors for network and system information discovery utilities (e.g., ifconfig, netstat, ip) executed by shells or remote access daemons. On Windows, it monitors for the use of WScript, CScript, WMIC, and WBEMTest in potentially suspicious ways, including the use of WMI for command execution.