npm RAT Dot-Prefixed Persistence Files Dropped in TEMP by python.exe or chost.exe
Detects the creation of files with filenames '.store' or '.host' (or any dot-prefixed file) within the Windows TEMP directory by specific processes (python.exe or chost.exe). This behavior is observed in certain npm-based Remote Access Trojans (RATs) to drop configuration and state files.
SentinelOne
