BIOC Informational

Enumeration command called by commonly abused CGO

Some malware uses these commands for reconnaissance.

Module:
Platform Analytics
Agent event type:
Process execution
Category:
Discovery
Status:
Enabled
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: Account Discovery (T1087) Remote System Discovery (T1018) System Network Configuration Discovery (T1016)
Indicator:

Process action type = execution AND target process name = net.exe , ping.exe , whoami.exe , arp.exe , nslookup.exe , hostname.exe , ipconfig.exe , systeminfo.exe Process cgo name = cscript.exe , wscript.exe , mshta.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , regasm.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe

Preventable: yes