Mustang Panda ZOHOMURK Reverse Shell via cmd.exe Pipe from pcl2bmp.exe
Detects the ZOHOMURK implant spawning an interactive cmd.exe shell via a piped process. The detection identifies cmd.exe child processes originating from the known sideloading host pcl2bmp.exe, indicating the potential use of the Shell_WriteCommand reverse shell mechanism commonly attributed to the Mustang Panda threat actor.
Microsoft Sentinel (KQL)
