Botking implant-issued Shell/ShellX/runscript command execution on build hosts

Duo Tech@duotech

•updated Aug 21, 2026•10•0•14

Detects the botking RAT issuing Shell/ShellX/runscript commands that spawn powershell.exe from an implant-named parent process, matching the backdoor's remote command-execution capability.