LabubaRAT File Write via nvidia-sysruntime.exe Upload Tasking
Detects file write operations performed by 'nvidia-sysruntime.exe', a known masquerading binary used by LabubaRAT. This activity signifies the RAT's operator-directed tasking where attacker-controlled data is written to the file system.
Microsoft Sentinel (KQL)
