CornFlake dropper masquerading as svchost32.exe/chrome_update.exe outside system paths (unsigned/mismatched cert)
Detects execution of files named svchost32.exe or chrome_update.exe running from non-system paths (AppData, Temp, Downloads) that are unsigned or whose code-signing certificate does not match the expected legitimate signer (Microsoft/Google), indicative of the CornFlake RAT dropper used by Midnight Blizzard/Storm-2945 in the CaptiveCrunch campaign.
Microsoft Sentinel (KQL)
