Silver Fox ValleyRAT Binary Proxy Execution
Detects the execution of rundll32.exe or regsvr32.exe loading a DLL from a user-writable, non-standard application data path. This is a technique used by ValleyRAT as part of the Silver Fox campaign to evade detection. The specific path 'AppData\Roaming\Embarcadero\' is a strong indicator of this threat.
YARA-L
