LabubaRAT PowerShell Execution Bypass from nvidia-sysruntime.exe

Duo Tech@duotech

•updated Jul 17, 2026•4•1•9

Detects the execution of PowerShell with bypass execution policy flags originating from the nvidia-sysruntime.exe process. This behavior is associated with the LabubaRAT malware, which leverages this specific parent process to execute malicious PowerShell commands while evading policy restrictions.