PostCSS RAT chost.exe Spawned from npm/PowerShell/wscript with C2 Beacon to nvidiadriver.net
Detects the execution of a Nuitka-compiled Python RAT (chost.exe) associated with the PostCSS typosquatting campaign. The rule identifies this malicious binary when spawned by wscript.exe, powershell.exe, or node.exe from a location outside of C:\Windows\, followed by network communication to known campaign-associated C2 infrastructure.
YARA-L
