Rust/Tokio DLL Loaded via msiexec Sizing Worker Pool via TOKIO_WORKER_THREADS/GetSystemInfo
Detects the loading of a malicious DLL into the msiexec.exe process that exhibits characteristic Rust/Tokio async-runtime initialization behavior. This includes exported function names like 'RUN' and specific interactions with the 'TOKIO_WORKER_THREADS' environment variable or API calls to 'GetSystemInfo' and 'CreateThread' to size the worker thread pool. This behavior is associated with msaRAT, where the DLL is loaded via MSI custom actions to run within the context of the Windows Installer service.
Sigma
