Staged KB-path runtime spawning cmd discovery (reg query, ipconfig /all, tasklist)

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•1•0•5

Detects an executable launched from a KB-numbered staging folder under AppDataRoaming spawning cmd.exe to execute multiple host and network discovery commands such as registry queries, ipconfig, or tasklist.