CmdID

CmdID / Commands

hostname

Displays the host name portion of the full computer name of the computer. Windows commands reference

On Windows, Linux 4 Sigma rules name it File hostname.exe

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0

Displays the host name portion of the full computer name of the computer. IMPORTANT: This command is available only if the Internet Protocol (TCP/IP) protocol is installed as a component in the properties of a network adapter in Network.

hostname
hostname
echo %COMPUTERNAME%
set "_CLUSTER_NETWORK_NAME_=Altered Computer Name"
hostname
/?Displays help at the command prompt.

Linux

from the toybox, 0BSD

Get/set the current hostname.

hostname [-bdsf] [-F FILENAME] [newname]
-bSet hostname to 'localhost' if otherwise unset
-dShow DNS domain name (no host)
-fShow fully-qualified name (host+domain, FQDN)
-F FILENAMESet hostname to contents of FILENAME
-sShow short host name (no domain)

Several platforms

from tldr-pages, CC BY 4.0

Show or set the system's host name.

Show current host name

hostnameIdentify

Trips 1 Sigma rule: informationalSystem Information Discovery by Ömer Günal, oscd.community

Show the network address of the host name

hostname --ip-addressIdentify

Trips 1 Sigma rule: informationalSystem Information Discovery by Ömer Günal, oscd.community

Show the FQDN (Fully Qualified Domain Name)

hostname --fqdnIdentify

Trips 1 Sigma rule: informationalSystem Information Discovery by Ömer Günal, oscd.community

Set current host name

hostname new_hostnameIdentify

Trips 1 Sigma rule: informationalSystem Information Discovery by Ömer Günal, oscd.community

What detects it

Sigma process creation rules that name hostname
highLinux Webshell IndicatorsFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
lowSuspicious Execution of Hostnamefrack113
informationalSystem Information DiscoveryÖmer Günal, oscd.community