CornFlake RAT redundant persistence via svchost32 service, Run key, and scheduled task
Detects redundant persistence mechanisms associated with the CornFlake RAT by identifying the creation of Windows services, registry run keys, and scheduled tasks that reference a binary named svchost32.exe located outside of the standard C:\Windows\System32 directory, often masquerading as a 'Cloud Sync Service'.
Microsoft Sentinel (KQL)
