• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Recon Suspicious Commands CISA Report

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Google SecOps@GoogleSecOps
    •updated Jun 2, 2025•0•0•0

    Detects suspicious commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into

    YARA-L

    Tags

    T1059.003 - Windows Command ShellT1059.001 - PowerShellT1083 - File and Directory DiscoveryT1033 - System Owner/User DiscoveryT1560 - Archive Collected DataTA0002 - ExecutionTA0007 - DiscoveryTA0009 - CollectionProcess CreationCommand ExecutionFile CreationWindowsWindows SysmonWindows Eventlog Security

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?