Staged KB-folder runtime spawning cmd discovery (reg query, ipconfig, tasklist)

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•1•0•2

Detects multiple distinct discovery commands (such as ipconfig, tasklist, or system version registry queries) executed via cmd.exe spawned from a parent process located in an AppData Roaming KB directory within a 30-minute window.