TinyRCT PerfWatson2.exe Sandbox Evasion Execution from LOCALAPPDATA
Detects the execution of the TinyRCT backdoor, which attempts to masquerade as the legitimate PerfWatson2.exe binary. The detection focuses on the process running from the AppData/Local directory, a common location for user-level malicious payloads.
YARA-L
