RomulusLoader File Persistence (Vulkan Sideloading)
Detects RomulusLoader persistence behavior where Vulkan components (vulkan-1.dll, vulkaninfo.exe) or encrypted payload files (.bin) are written to the Common Files directory by the TA4922 threat actor.
Microsoft Sentinel (KQL)
