SilverFox Sauron RAT Deployment via RPC Task and Svchost Self-Copy

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects various indicators associated with the SilverFox loader deploying the Sauron RAT, including registry markers, service creation, self-copying of svchost.exe, specific marker file artifacts, and known C2 communication.