Uncommon command was executed on a device

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	VMware virtualization servers syslogs
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	Command and Scripting Interpreter (T1059)
Severity	Informational

Description

An uncommon command was executed. This behavior may indicate an adversary who gained access to the device.

Attacker's Goals

Execute tooling, shells, or other malicious commands on the device.

Investigative actions

• Confirm whether the command is part of a legitimate change / maintenance activity on this device.

• Review who initiated the session on the device around the execution time.

• Check whether the same uncommon command appears on other devices.

Variations

Uncommon sensitive command was executed on a device

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	Command and Scripting Interpreter (T1059)
Severity	Informational

Description

An uncommon command was executed. This behavior may indicate an adversary who gained access to the device.

Attacker's Goals

Execute tooling, shells, or other malicious commands on the device.

Investigative actions

• Confirm whether the command is part of a legitimate change / maintenance activity on this device.

• Review who initiated the session on the device around the execution time.

• Check whether the same uncommon command appears on other devices.