Regasm Executing Text File Payload
Identifies regasm.exe executing a payload disguised as a .txt file. This technique is used by the CloudZ RAT dropper to execute its disguised .NET loader via a scheduled task while evading standard executable-based alerting. The rule specifically looks for 'regasm.exe' in the process image name and '.txt' in the command line, with additional specificity for '/nologo', 'update.txt', or 'msupdate.txt' to narrow down to known campaign indicators.
Cortex XDR
