Sauron Loader Side-Load Chain With No Follow-On C2 (Geo-Gating)

Ibrahim Saud@tektrix

•updated 12 days ago•0•0•2

Detects instances where the process rnpkeys.exe loads suspicious DLLs (rnp.dll or tdwp.dll) without subsequent network activity within a 120-second window. This behavior is indicative of potential DLL side-loading where the process is used to execute malicious payloads without establishing communication.