DPRK NPM Infostealer MicrosoftSystem64 Persistence Execution
Detects process execution originating from the suspicious '%LOCALAPPDATA%\MicrosoftSystem64' directory, which is used as a persistence mechanism by a North Korean-linked npm infostealer RAT.
Sigma
