Batch Execution from Public Music

Elgonad .@elgonad

•updated Apr 7, 2026•4•0•103

Detects the execution of a batch file from the non-standard C:\Users\Public\Music\ directory via cmd.exe. This behavior is associated with the intermediate stage of Kimsuky campaigns where it is used to download further payloads.