Suspicious cmd.exe token.cmd Creation and Execution

Arnold Chan@slaz

•updated Sep 21, 2026•0•0•3

Detects creation of a token.cmd file in AppData followed by its execution via cmd.exe within a 5-minute window.