CornFlake RAT persistence via svchost32 Run key, scheduled task, or watchdog relaunch

Ethan Andrews@eandrews

•updated Aug 3, 2026•2•0•2

This rule detects persistence mechanisms associated with the CornFlake RAT by identifying three specific activities: the creation of Windows Registry Run or RunOnce keys referencing 'svchost32', the creation of scheduled tasks using 'schtasks.exe' that involve 'svchost32', and a watchdog process pattern where a 'svchost32' process is launched by a parent process that is also identified as 'svchost32'.