Executable Masquerading as Image File (ClickFix RAT)
Detects the creation or execution of specific file artifacts associated with the ClickFix RAT that disguise Python executables or bytecode as standard image files to evade detection. The rule specifically looks for file names 'mev.png', 'uso.ico', or 'uso.png' in file or process events.
Cortex XDR
