MSI from public repo launches Deno RAT chain
This rule links downloading a Windows installer from a public GitHub repo with a Deno remote-access chain starting afterward. Trojanised releases abuse trust in open source. Only install signed builds from official vendors. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Microsoft Sentinel (KQL)
