Vidar Turb00 CorsairUtil Masquerading via agt.dll

Ethan Andrews@eandrews

•updated Jun 16, 2026•4•0•8

Detects the creation or execution of a file named 'agt.dll' within a masqueraded 'CorsairUtil' directory, a defense evasion tactic used by the Vidar Turb00 campaign. This rule monitors both file drops (DeviceFileEvents) and DLL loads (DeviceImageLoadEvents) for the specific path and filename combination.