Suspicious ModeloRAT Persistence and Payload Execution Artifacts
Detects suspicious scheduled task creation, DLL execution, and campaign related artifacts such as TempLogA, ssss.dll, com6848.dll, collector.py, Pmanager.py, and WinPython execution paths that may indicate ModeloRAT persistence or post compromise activity.
Microsoft Sentinel (KQL)
