Rust/Tokio Runtime Worker Thread Sizing via TOKIO_WORKER_THREADS and GetSystemInfo (Weak Signal)
The implant's runtime initialization behavior — Tokio worker-thread sizing via TOKIO_WORKER_THREADS env var or GetSystemInfo. This behavior alone is a generic characteristic of any legitimate Rust/Tokio-based application and has very weak standalone specificity for msaRAT. Do NOT action this alert in isolation. It should only be treated as meaningful when correlated with other msaRAT indicators observed in the same process tree, such as a headless browser (Chrome or Edge) being launched or Chrome DevTools Protocol (CDP) activity occurring from the same parent/child process lineage. Use this rule strictly as a low-confidence enrichment/supporting signal for triage and correlation, not as a standalone detection.
Cortex XDR
