CRPx0 Disguised PE DLL Download as WindowsUpdate.log
Detects the creation of a large file (exceeding 4MB) named 'WindowsUpdate.log' on the system. This behavior is indicative of a masquerading attempt where a malicious PE DLL is disguised with the extension of a known legitimate log file, a technique observed in the CRPx0 ClickFix lure to evade security inspection.
YARA-L
