TAG-195 ChonkyChicken cred_exec/token_run Commands Within WebSocket C2 Message Schema
Detects cred_exec/token_run command tokens within the TAG-195 WebSocket C2 message schema, used for credential/token-backed lateral movement.
Cortex XDR
Detects cred_exec/token_run command tokens within the TAG-195 WebSocket C2 message schema, used for credential/token-backed lateral movement.
Already have an account?