Sauron Loader: rnpkeys.exe side-loads rnp.dll/tdwp.dll from ProgramData\keyroll
Detects the execution of rnpkeys.exe dropped by an MSI installer (msiexec.exe) from the C:\ProgramData\keyroll directory. The rule specifically monitors for side-loading of the rnp.dll or tdwp.dll libraries by rnpkeys.exe, a technique associated with the Sauron loader.
Splunk (SPL)
