N-central Take Control Session Followed by Process Enumeration (CVE-2026-18577)

Ethan Andrews@eandrews

•updated Aug 4, 2026•3•0•10

Detects process discovery activities (using tasklist.exe, wmic, or Get-Process) performed on a Windows endpoint shortly after an 'MSP Support' account logon, commonly associated with reconnaissance during exploitation of N-able N-central vulnerabilities.