CornFlake RAT correlated posture recon from unsigned/uncommon process
Detects reconnaissance of system security posture by unsigned or unknown processes. The rule monitors for a combination of AV/EDR product enumeration (SecurityCenter2, Windows Defender exclusion queries), RDP history collection, Office MRU collection, and general system information gathering. It correlates two or more of these activities originating from the same process within a 15-minute window, while excluding known legitimate security and management software.
Microsoft Sentinel (KQL)
