Millenium RAT Process Enumeration and System Recon from AppData Parent
Detects reconnaissance activities performed by suspicious binaries executing from user-writable directories (AppData or Temp). The rule specifically monitors for process enumeration commands like tasklist.exe, wmic process list, and Get-Process executed by parent processes located in these paths, which is indicative of the Millenium RAT profiling its victims.
Sigma
