CornFlake RAT Persistence and Service Creation

Lacey Cochrane@NullVectorX

•updated Aug 24, 2026•2•0•13

Detects persistence and configuration activity associated with the CornFlake RAT, including the creation of malicious Windows services (e.g., 'svchost32', 'Cloud Sync Service'), registry run key modifications, and the presence of specific file artifacts like 'sync.dat' and malicious executables within AppData directories.