CmdID

CmdID / Commands

recon-ng

Automated reconnaissance and information gathering tool. tldr-pages

On several platforms 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Several platforms

from tldr-pages, CC BY 4.0

Start the tool in interactive mode

recon-ngIdentify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

[Interactive] Create a workspace

workspaces create workspace_name

[Interactive] Search the marketplace for modules used to accomplish different reconnaissance tasks

marketplace search

[Interactive] Install all available modules (some may need API keys to function completely)

marketplace install all

[Interactive] Load the profiler module. It is used to scan the web for profiles matching the target, scrape them, and store them

modules load profiler

[Interactive] Insert the target's username. After entering this command, enter the desired username of the search and leave the rest of the options blank

db insert profiles

[Interactive] Run the current module

run

What detects it

Sigma process creation rules that name recon-ng
highLinux HackTool ExecutionNasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])