TAG-195 ChonkyChicken Domain Recon Commands in WebSocket C2 Traffic
Detects network-based enumeration of Active Directory components, including user accounts, computer objects, group memberships, session information, and domain trust relationships. This pattern is characteristic of automated discovery tools used during the reconnaissance phase of an attack.
Cortex XDR
