CaptiveCrunch - CornFlake RAT install (fake progress window + "Cloud Sync Service")
This rule detects the creation of a Windows service named 'Cloud Sync Service' using command-line tools like 'sc.exe' or 'New-Service', or via direct service event monitoring. This behavior is often associated with malware persistence mechanisms that use misleading names to blend in with legitimate software services.
Microsoft Sentinel (KQL)
