Commands to Avoid
Issuing common host recon commands like "whoami", "net" etc. could trigger alerts in defense systems if chained due to the fact that EDRs can detect these via behavioral analysis.
Using these commands can also risk being logged via command line logging or script logging, in which defenders can analyze and probably act upon these commands.
To minimize our footprint, we can either do two things:
- 1.Use the compromised computer as a proxy and pivot to the network to perform enumeration activities.(Use tools like rpcclient, impacket etc.)
- 2.Use Code and such to gather info and execute commands
Note that if you take the proxy route, you will lose being in the context of the user due to the fact that Windows SSO is not applicable in your situation. You will have to find credentials in some way to gain back context.