WinRAR-extracted payload spawns identical self-copy child process from temp/download path
Detects a WinRAR-extracted OnyxC2 loader spawning an identical self-copy child process from a temp/download path, marking the transition from loader stage to active stealer logic.
Microsoft Sentinel (KQL)
