C2Looper Discovery Command Sequence (ipconfig/whoami/nltest/net group/wmic)

Duo Tech@duotech

•updated Aug 18, 2026•2•0•5

Detects at least 3 distinct C2Looper-associated discovery commands (ipconfig /all, whoami /all, nltest /dclist, net group /domain "domain admins"/"domain computers", wmic product get name,version) executed by the same parent process within a 60 second window, reducing false positives from isolated legitimate admin usage of any single command.