Discovery commands (systeminfo, nltest, whoami, quser) via AdaptixC2 beacon

Emiliano Mema@Nosalva

•updated Aug 18, 2026•1•0•6

Detects rapid execution of multiple system discovery commands (systeminfo, nltest, whoami, quser, ping) within a 15-minute window on a single host. Attackers often use these tools sequentially to gather intelligence about the environment, user identity, and network topography post-compromise.