ChocoPoC RAT Hidden Python Re-spawn via CREATE_NO_WINDOW

Ethan Andrews@eandrews

•updated Jul 1, 2026•4•0•14

Detects the persistence and execution mechanism of ChocoPoC RAT, where a Python interpreter is spawned in a hidden window using the CREATE_NO_WINDOW flag (0x08000000). The rule monitors command-line arguments and parent-child process relationships for indicators of the RAT's module import, specific environment variables used for anti-recursion loops, and process spawns originating from existing Python instances.