Sauron Loader keyroll Process Establishes Outbound Connection Post Gating

Ibrahim Saud@tektrix

•updated 10 days ago•1•0•1

Detects the execution of suspected Sauron Loader components staged in C:\ProgramData\keyroll\ (rnpkeys.exe or tdwp.dll) followed by an outbound network connection from the same host within a 2-minute window. This behavior correlates the staging of malicious binaries with the loader's automated outbound registration attempt.