Screening Serpens - Connection.dll Decoy Execution

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•1

Identifies the execution of the Connection.dll RAT spawning the decoy Meeting Room process, specifically looking for the loading of 'Connection.dll' and the simultaneous execution of 'SystemtUpdateTaskMachine.exe' by the same initiating process.