Sauron Loader DLL Side-Loading via rnpkeys.exe in ProgramData\keyroll

Ibrahim Saud@tektrix

•updated 12 days ago•0•0•2

Detects the execution of the process 'rnpkeys.exe' initiated by 'msiexec.exe' from the '\ProgramData\keyroll\' directory. This activity may indicate malicious use of the Windows Installer to proxy the execution of unauthorized or potentially malicious key management software.