PostCSS RAT: VBScript tar extraction and chost.exe RAT loader launch
Detects the PostCSS typosquatting campaign VBScript bootstrapper (update.vbs) using cmd.exe to extract dll.zip via tar, then launching the renamed Python executable chost.exe with loader.py to initialize the Windows RAT payload. This rule correlates two distinct process events: a wscript.exe initiated cmd.exe process executing 'tar -xf dll.zip', followed by a 'chost.exe' process executing 'loader.py' on the same device and account within a 5-minute window.
Microsoft Sentinel (KQL)
