Recon Command Output Redirected to Temporary File

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the execution of common Windows reconnaissance commands (ipconfig, net, netstat, ping, systeminfo, tasklist, whoami) with their output redirected to a file via the ">" operator. Attackers and post-exploitation frameworks commonly use this pattern to silently collect host enumeration data and stage it for later retrieval, rather than displaying output interactively or piping it to another tool.

2026-09-04 00:00:00

None

b7d4e1f3-9a2c-4b8e-c6f1-3e8d5a7b2c9f

attack.discovery attack.t1057

Nextron Sigma feed only (private)