pc-app.exe spawns cmd/powershell running whoami/ver/tasklist recon

Arnold Chan@slaz

•updated 26 days ago•1•0•3

Detects the execution of common discovery commands like 'whoami' combined with system information gathering commands (tasklist, ver, uname) when initiated by an application named 'pc-app.exe'. This pattern is frequently observed during the reconnaissance phase of an attack.