CornFlake RAT high-volume unsigned bulk collection of sensitive-extension files and post-USB file enumeration
Detects anomalous, high-volume file access (creation, modification, or renaming) targeting sensitive extensions (e.g., .key, .pem, .pfx) within document directories by unsigned processes. It also detects similar high-volume file access behavior that occurs immediately following the mounting of a removable USB device, consistent with CornFlake RAT data exfiltration patterns.
Microsoft Sentinel (KQL)
