TA4922 RomulusLoader: Browser-Spawned Execution from User-Writable Paths or Vulkan DLL Sideload

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

This rule detects post-click execution chains typical of RomulusLoader delivery, specifically identifying when browser or archive applications launch unsigned processes from user-writable directories (e.g., Downloads, Temp), or when a suspicious vulkan-1.dll module is sideloaded from these same directories.