CL-STA-1062 TinyRCT AppDomainManager Injection via chrome_setup.zip
This rule detects malicious activity associated with the TinyRCT backdoor, specifically focusing on the AppDomainManager injection technique. It monitors for the presence of known malicious file names, specific process command-line arguments involving VMware paths, and known file hashes connected to the chrome_setup.zip attack chain, as well as network communication with known malicious IP addresses.
Microsoft Sentinel (KQL)
