COLDSTEEL RAT Service Persistence Execution
Detects the creation of an 'svchost.exe' process with specific command line flags ('-k msupdate', '-k msupdate2', or '-k alg') that have been observed in use by the ColdSteel RAT for persistence and defense evasion. This pattern indicates the RAT establishing itself as a service to maintain access on a compromised system.
Sigma
