ROOTBOY RemotePC rpccmdhost.exe spawning hidden PowerShell to C2 212.80.7.74
Detects the RemotePC RMM component (rpccmdhost.exe) being used to spawn PowerShell processes with suspicious command-line arguments. The rule specifically looks for evidence of hidden PowerShell execution designed to bypass TLS certificate validation and download external scripts or stagers from a known C2 IP address associated with ROOTBOY activity.
YARA-L
