CornFlake RAT svchost32.exe correlates capture API use with WAV/JPEG artifact writes
Detects the CornFlake RAT masquerading as 'svchost32.exe' executing from within user AppData directories. The rule correlates the initiation of audio/video capture APIs (WASAPI or MediaFoundation) by this process with the subsequent creation of .wav, .jpg, or .jpeg files, suggesting unauthorized audio or camera capture by the malicious process.
Microsoft Sentinel (KQL)
