Dangerous commands and execution

This category groups related risk explanations. A finding is a reason to review the activity and its context, not proof that a breach occurred.

Risk types

• Destructive system commands

  A command resembles a broad deletion, disk-formatting operation, or other system-damaging action.

• Encoded or indirect command execution

  A command uses a recognized decode-and-run or inline execution pattern.

• Reverse shell patterns

  A command resembles a shell connected to another process or remote endpoint.

• Cloud metadata service references

  A tool parameter refers to a recognized cloud instance metadata address.

• Credential directory collection

  A command resembles archiving or recursively copying credential directories.

• SSH tunnels and proxies

  A command resembles selected SSH forwarding or proxy options.

• Shell history and log removal

  A command resembles clearing shell history or deleting, truncating, or shredding selected logs.

• Package publishing activity

  An agent invokes or stages a recognized package publishing command.

• API endpoint redirection

  A command or saved configuration contains a recognized API endpoint override.

Event categories

These event category values map to this library category: threat_command. Use the rule index to find the explanation for a specific rule ID.