NJRAT Netsh firewall allow rule added by process in user-writable path

Arnold Chan@slaz

•updated 25 days ago•0•0•2

Detects processes running from user-writable locations (Temp/AppData/Public/Downloads) creating a self-referential Windows Firewall allow rule via netsh, consistent with NJRAT establishing outbound C2 connectivity while evading network-based blocking.