COLDSTEEL RAT Anonymous User Process Execution
Detects the creation of a process executing as a user named "ANONYMOUS" where the parent process image path contains common system or user application directories. This behavior has been observed in the "MileStone2016" variant of the COLDSTEEL RAT.
Sigma
