MINIRECON Discovery Commands Spawned from MediumInstStart.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects execution of common discovery utilities (whoami, ipconfig, net, etc.) by the suspicious process 'MediumInstStart.exe', often indicative of an adversary performing reconnaissance after initial access or persistence.