Showboat - Telecom Config Reconnaissance Sequence (T1005)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•2

Uses time-windowing to detect a single anomalous process rapidly opening multiple telecom billing/radius .xml or .cfg files, indicating automated config parsing prior to exfiltration.