BabylonRAT ProgramData\Firefox staging, exec, and RunOnce persistence

Arnold Chan@slaz

•updated Sep 17, 2026•1•0•3

This rule detects a sequence of suspicious activities involving files placed in 'ProgramData\Firefox'. It identifies the creation or modification of a non-standard executable within this folder, followed by its execution by a trusted process (or itself), and the subsequent creation of a Registry run key for persistence. This pattern is often used by adversaries for persistence mechanism implementation using masqueraded file names.