BabylonRAT masquerading as Firefox executed from non-standard path

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•0

Detects instances of 'firefox.exe' executing from locations other than the standard Mozilla installation directories, such as AppData, Temp, Downloads, or ProgramData. Additionally, the rule validates if the binary is digitally signed by Mozilla. This behavior is indicative of a masquerading attempt, where an attacker runs a malicious executable disguised as Firefox.