Toy Ghouls bird-agent backdoor machine-bound config sealing
Detects the presence of Toy Ghouls' mqtt-bird-agent or matrix-bird-agent backdoor binaries. These binaries are identified by specific filenames, the inclusion of ChaCha20-Poly1305 cryptographic indicators, and operations involving the Windows MachineGuid registry key used to seal configuration files.
YARA
