LabubaRAT nvidia-sysruntime.exe Spawning cmd.exe or powershell.exe for Shell Tasking

Kaung Khant Ko@kaungkhantko

•updated Jul 15, 2026•1•0•2

This rule detects the LabubaRAT malware utilizing the 'nvidia-sysruntime.exe' process to spawn 'cmd.exe' or 'powershell.exe' for command-and-control tasking. It monitors process creation events to identify suspicious parent-child relationships where the NVIDIA system runtime binary is used to invoke command shells with specific command-line arguments, typical of RAT shell tasking behaviors.