Fileless Malware

Splunk-ShadowRoast

April 14, 2026

Splunk SOC SIEM Log Analysis DFIR Windows Sysmon Active Directory AS-REP Roasting Rubeus Mimikatz Credential Dumping Process Injection Fileless Malware PowerShell RDP

A masqueraded AdobeUpdater.exe binary established persistence via a registry Run key, injected into cmd.exe, performed AS-REP Roasting with Rubeus against four AD accounts, laterally moved to FileServer using cracked tcooper credentials, enabled RDP, and staged share data for exfiltration.

LD-Suspicious PowerShell Script Executed

March 14, 2026

SOC SIEM EDR PowerShell Fileless Malware Sandbox Evasion True Positive VirusTotal

User Tony downloaded and executed a malicious PowerShell script (payload_1.ps1 / agent3.ps1) classified as trojan.powershell/boxter (Azorult family). The script bypassed execution policy, then fetched and invoked a second-stage payload from kionagranada.com (161.22.46.148), establishing a two-stage C2 chain with a final pivot to 91.236.116.163.

↑