Malicious Svchost-Group Service 'CadenceOptimizer' Loading agt.dll (Corsair Masquerade)
This rule detects potential malicious activity associated with the 'CadenceOptimizer' service and related 'agt.dll' library. It monitors for the creation or modification of Windows Registry keys for persistence, the creation or loading of a specific DLL in the 'ProgramData\CorsairUtil' directory, and the injection of code into 'svchost.exe' via 'Brn_Agent' command line arguments.
Cortex XDR
