LabubaRAT SQLite staging database creation (nvctr_sys.db)
Detects the creation of SQLite database files associated with the LabubaRAT malware implant. The rule monitors for the nvidia-sysruntime.exe process creating specific database files (nvctr_sys.db and its associated journal/shared memory files) which are used for staging collected data.
Sigma
