PowerShell reverse shell spawned by Qlik Sense scheduler.exe (CACTUS)

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•1•0•3

Detects behavioral indicators where the Qlik Sense scheduler process (scheduler.exe) spawns PowerShell with reverse shell command-line arguments, initiates outbound network connections via PowerShell, or connects to known malicious staging IP infrastructure.