Millenium RAT masquerading process exfiltrating system recon data to Telegram C2
Detects potential Millenium RAT activity where a process masquerading as a legitimate system file (e.g., svchost.exe or MsEdgeUpdate.exe) is executed from a non-standard directory and subsequently initiates network communication with the Telegram Bot API within a one-hour window. This behavior is indicative of malware beaconing and exfiltrating victim profiling data.
Microsoft Sentinel (KQL)
