LabubaRAT File System Manipulation via nvidia-sysruntime.exe

Duo Tech@duotech

•updated Jul 17, 2026•1•0•1

Detects execution of the process named nvidia-sysruntime.exe, which is identified as a malicious component associated with LabubaRAT. The rule monitors for file system events triggered by this specific binary, which is masquerading as a legitimate NVIDIA component.