ModeloRAT Persistence Mechanisms Detection

Kaung Khant Ko@kaungkhantko

•updated Jun 25, 2026•1•0•3

Detects persistence mechanisms associated with ModeloRAT, specifically monitoring for suspicious Registry Run key entries, scheduled tasks, and startup folder items that execute 'pythonw.exe' or 'WPy64-31401' based binaries.