Initial investigation
On gaining access, attackers run built-in commands to learn about the infected machine — its OS, network, and running processes — often to confirm it is not an analysis sandbox.
- tasklist — list running processes
- ver — report the OS version
- ipconfig — show network configuration
- systeminfo — detailed system information
- net time / net start — time source and running services
- netstat — active network connections
- whoami — identify the current user
- qprocess / query — process and session queries
Reconnaissance
Attackers search the machine and the surrounding network for files, accounts, and shares worth stealing or using to move laterally.
- dir / type — enumerate and read files
- net view / net share — discover domain resources and shares
- net user / net localgroup / net group — enumerate accounts and groups
- net use — access remote resources
- ping — probe network reachability
- dsquery / csvde — query Active Directory (often downloaded by attackers)
Spread of infection
To move to other machines, attackers use commands that execute or register tasks remotely.
- at — schedule remote command execution
- reg — modify the registry
- wmic — execute processes on remote machines
- sc — manage services
- netsh advfirewall — modify firewall rules
- wusa / rundll32 — run installers and load libraries
Mitigation
Because many of these commands are unused by normal users, restricting them with AppLocker or software-restriction policy — and logging execution via process-creation auditing or AppLocker monitoring — can detect or contain attacker activity at an early stage. JPCERT/CC recommends starting with process-execution logging.