PostCSS RAT chost.exe Registry Run Key Persistence with Process Masquerade
Detects a malicious persistence mechanism where a suspicious process ('chost.exe') is registered in the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key to execute at startup. The rule specifically monitors for registry keys pointing to temporary directories or unconventional path structures often associated with this RAT, while correlating this with the execution of the process from a non-system directory (i.e., outside System32/SysWOW64).
YARA-L
