System trespassing, which refers to the unauthorized access of computer systems, has rapidly become a worldwide phenomenon. Despite growing concern, criminological literature has paid system trespassing little attention. The current study utilizes data gathered from a Chinese computer network to examine system trespasser behavior after exposure to one of three warning messages: an altruistic message used for moral persuasion (warning 1), a legal sanction threat (warning 2), and an ambiguous threat (warning 3). More specifically, the current study examines the temporal order of various keystroke commands to determine if some keystroke commands are used as a tactical skill to avoid detection. The results of a series of bivariate cross-tabulations show that encountering a standard legal threat or ambiguous threat increase the early use of reconnaissance commands; however, these findings were not pronounced enough to gain statistical significance. Since the current study is the first known test of particularistic restrictive deterrence in cyberspace it informs those working in cyber security, whilst expanding the scope of the theory.