PureRAT Execution or Persistence

Bhojraj Joshi@cybrbhojrajjoshi

•updated Apr 23, 2026•1•0•232

Detects suspicious execution paths for svchost.exe, known malicious SHA256 hashes, or suspicious registry persistence mechanisms. Specifically, it looks for svchost.exe or a file named images.png executing from the 'Users\Public\Windows' directory, known malicious hashes, or a registry run key named 'Windows Update Service' under 'Software\Microsoft\Windows\CurrentVersion\Run'.