PDF Decoy Auto-Opened from Downloads via PowerShell Start-Process (CrySome RAT)
Detects the execution of PowerShell commands that attempt to open or process a specific suspicious PDF file named 'Rate_Confirmation_LD-2026-0847.pdf' located in user download directories. This pattern is often indicative of social engineering attempts where a user is tricked into opening a malicious file.
Cortex XDR
