CmdID

CmdID / Techniques

T1217 Browser Information Discovery

Adversaries may enumerate information about browsers to learn more about compromised environments. MITRE ATT&CK

2 Sigma rules T1217 on attack.mitre.org

Sigma rules tagged with it

process creation, the highest levels first
lowFile And SubFolder Enumeration Via Dir Commandfrack113 · Windows
lowSuspicious Where Executionfrack113, Nasreddine Bencherchali (Nextron Systems) · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

To display all directories one after the other, in alphabetical order, in wide format, and pausing after each screen, make sure that the root directory is the current directory, and then type on the page for dir

dir /s/w/o/pIdentify

To alter the preceding example so that dir displays the file names and extensions, but omits the directory names, type on the page for dir

dir /s/w/o/p/a:-dIdentify

To display a list of all the file names with the .txt extension in all directories on drive C, type on the page for dir

dir c:\*.txt /w/o/s/pIdentify

An example is here when CmdID’s reading of it names T1217: a Sigma rule it trips is tagged with it, or its abuse is documented as it.