Go RAT keylogger module execution via kujjwvgqsr/antivm artifacts

Arnold Chan@slaz

•updated 24 days ago•1•0•1

This rule detects potential malicious activity by monitoring for specific file hashes, specific suspicious filenames, and suspicious command-line patterns (e.g., 'antivm') initiated by known update or launcher processes. This is likely an indicator of malware behavior involving anti-sandbox or evasion techniques.