CornFlake RAT High-Volume File Enumeration/Read by Malicious svchost32.exe Path Approaching Throttle Limits
Detects a process running from a path ending in svchost32.exe performing an unusually high volume of file open/read/rename/write operations or transferring a large total byte volume within a 1-hour window, consistent with CornFlake bulk file collection/exfiltration nearing its documented throttle limits.
Cortex XDR
