cmd.exe Spawned by regsvr32-Loaded TAG-195 Implant (Chrom/ChonkyChicken OCX) with Redirected I/O
Detects an interactive cmd.exe shell launched in quiet mode with redirected I/O by a regsvr32-loaded TAG-195 implant, matching shell_start C2 tasking.
Cortex XDR
