PS1Bot/ModeloRAT Post-Compromise Domain Recon Burst from Browser-Spawned Shell

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•7

Detects suspicious reconnaissance activity involving multiple common Windows discovery tools (nltest, net, dsquery, ipconfig, whoami, systeminfo) executed within a short time window (5 minutes) that was preceded (within 30 minutes) by a command shell (powershell.exe or cmd.exe) spawned by a web browser or common script-based execution engine (e.g., mshta.exe). This pattern is indicative of a post-exploitation phase where an attacker, having gained execution via a browser-based delivery method, performs environment discovery.