Kimsuky Base64 Recon Exfiltration via Multipart POST to dynv6 C2 (finalservice.php)
Detects wscript.exe or powershell.exe processes exfiltrating system reconnaissance inventory (computer, OS, process, and directory listings) via HTTP POST requests using multipart/form-data. The activity involves Base64-encoded payloads transmitted to PHP endpoints (e.g., finalservice.php) hosted on dynamic DNS (dynv6.net) infrastructure, often associated with the Kimsuky threat group.
Cortex XDR
