UsoClient64.exe Execution from Abnormal Directories (10FXRAT)

Ethan Andrews@eandrews

•updated Jun 8, 2026•3•0•3

Detects the execution of the legitimate Windows binary 'usoclient64.exe' from unusual directories. This behavior has been observed in campaigns by the threat actor 10FXRAT for DLL side-loading and persistence.