BambooToken: Kingsoft/WPS or Tendyron OnKey masquerade/side-load

Ankit Mehta@Secvyn

•updated 24 days ago•2•0•3

This rule identifies the execution of specific binaries (Kingsoft Office suite and Onkey/Tendyron components) from suspicious or uncommon directories such as temporary folders, user downloads, or public directories, which may indicate the staging and execution of malicious payloads masquerading as legitimate software.