CertEnrollCtrl.exe from non-system path spawning shell with AD recon

ills3c Intel&Coffee@Ills3C

•updated today•0•0•1

Detects execution of CertEnrollCtrl.exe from a non-system path (indicating potential DLL side-loading), which subsequently spawns a command shell (cmd.exe or powershell.exe) and executes Active Directory reconnaissance tools such as nltest.exe, whoami.exe, net.exe, or findstr.exe.