CopperDragon Activity Chain Detected

Kaung Khant Ko@kaungkhantko

•updated yesterday•3•0•7

Detects a behavioral chain associated with CopperDragon activity, combining admin account creation or modification mentioning admin$, Lanman service configuration for autostart, inbound TCP port 445 firewall rule creation via netsh, and modification of the LocalAccountTokenFilterPolicy registry key.