Irregular interactive command prompt activity detection

A system, comprising:

• a processor, and
• at least one memory storing instructions executed by the processor to perform actions including:
• receiving event data comprising an indication of an occurrence of an interaction between a user and an interactive command prompt,
• wherein the interaction between the user and the interactive command prompt comprises an entry of interaction data into the interactive command prompt,
• assigning a score to the occurrence,
• wherein the score is based on irregularity of the occurrence with respect to the user, and
• wherein the score is independent of the interaction data;
• and
• determining, based at least in part on the score, whether to generate an alert, wherein the alert identifies the occurrence as potential malicious activity.

A computer-readable storage medium storing computer-readable instructions, that when executed by a processor, cause the processor to perform actions comprising:

• detecting, by a sensor deployed in a network, an occurrence of an interaction between a user of the network and an interactive command prompt at the network;
• wherein the interaction between the user of the network and the interactive command prompt at the network comprises an entry of interaction data into the interactive command prompt;
• determining whether the occurrence comprises potential malicious activity at the network, wherein the determining whether the occurrence comprises potential malicious activity comprises assigning a score to the occurrence, wherein the score is based on irregularity of the occurrence with respect to the user, and wherein the score is independent of the interaction data;
• and
• generating an alert in response to a determination that the occurrence comprises potential malicious activity at the network.