PAPERMILL loader sandbox-evasion delay before RuntimeBroker persistence

Ankit Mehta@Secvyn

•updated Sep 16, 2026•0•0•2

Detects the execution of known PAPERMILL/VenomRAT loader samples, identified by specific suspicious file names. The detection monitors for the initiation of these processes, followed by a delayed (5-10 minutes) creation of RunOnce registry persistence entries that masquerade as RuntimeBroker.