BeepRAT Webcam Capture via DirectShow — TCC/HFY Infection Chain
This rule monitors for the execution of suspicious processes named 'HFY.exe' or 'tcc.exe' located in specific directories, and identifies any child processes spawned by them. This is often used to track the activity of specific malicious binaries or unauthorized tools that attempt to launch further processes to carry out additional stages of an attack.
CQL
