The DFIR Report on Twitter: "APT35 Automates Initial Access Using ProxyShell ➡️Initial Access: #ProxyShell ➡️Discovery: net, ipconfig, PowerShell, quser, etc. ➡️PrivEsc: Scheduled Task ➡️Defense Evasion: Real-time Monitoring & WDigest enablement ➡️Credential Access: Comsvcs.dll https://t.co/cpwniE2Juc" / Twitter