Quick execution of a series of suspicious commands

Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing. Commands of interest: - arp.exe - at.exe - attrib.exe - cscript.exe - dsquery.exe - hostname.exe - ipconfig.exe - mimikatz.exe - nbstat.exe - net.exe - netsh.exe - nslookup.exe - ping.exe - quser.exe - qwinsta.exe - reg.exe - runas.exe - sc.exe - schtasks.exe - ssh.exe - systeminfo.exe - taskkill.exe - telnet.exe - tracert.exe - wscript.exe - xcopy.exe ### Output Description The host on which the commands were executed, the time of execution, and what commands were executed