SilverFox Payload Post-Execution Persistence, Keylogging, RAT Beacon

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•3

This rule correlates a suspicious process execution (identified by specific command-line indicators), with subsequent persistence modification in Windows Registry Run/RunOnce keys, and a subsequent external network connection (excluding internal IP ranges). The activity is captured within a 15-minute window, suggesting a multi-stage attack pattern involving execution, establishing persistence, and initiating C2 communication.