Recon, PowerShell and .top beacon from remote-access tool session

ills3c Intel&Coffee@Ills3C

•updated yesterday•3•0•7

Detects reconnaissance commands (whoami, systeminfo) and PowerShell execution spawned as children of remote-access tools (such as AnyDesk, ScreenConnect, TeamViewer/QuickAssist variants, etc.), followed shortly by an outbound network connection to a .top domain from the same device.