Millenium RAT MsEdgeUpdate masquerade with Telegram C2 and Run key persistence

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects Millenium RAT payloads that masquerade as legitimate Windows processes (such as MsEdgeUpdate or svchost.exe) by running from temporary directories (AppData or Temp). The rule also monitors for associated persistence mechanisms via HKCU Run registry keys.