Staged KB-prefixed AppData runtime connecting to LDAPS, SMB, Kerberos and HTTP

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•2•0•6

Detects a portable runtime launched from a KB folder under AppDataRoaming that establishes network connections to multiple domain-infrastructure ports (such as ports 88, 445, 636 for AD CS or domain services enumeration), indicative of potential internal reconnaissance or abuse.