Millenium RAT Process Enumeration via CreateToolhelp32Snapshot from Suspicious Paths

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects bulk process enumeration performed by suspicious or masquerading processes using Windows system APIs (CreateToolhelp32Snapshot, NtQuerySystemInformation, ProcessSnapshot). This activity is often associated with post-compromise reconnaissance and information gathering, specifically seen in Millenium RAT variants.