BeepRAT HFY.exe Execution from Trojanized Chinese Telecom Utility ZIP
Detects the execution of 'HFY.exe' correlated with the presence of specific DLLs (e.g., data.dll, EPPlus.dll) characteristic of a trojanized Chinese telecom management utility. This behavior is indicative of the BeepRAT infection chain, where malicious binaries are executed from archives containing secondary dependencies.
Microsoft Sentinel (KQL)
