BabylonRAT Dynamic API Resolution via Firefox-Masquerading Process

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•0

This rule detects instances of a process named 'firefox.exe' that is executing from a directory other than the standard 'Mozilla Firefox' program folders. When this masquerading process loads critical system DLLs like 'kernel32.dll' or 'ntdll.dll', it flags potential dynamic API resolution activity commonly associated with BabylonRAT and similar malware that attempts to hide its capabilities by resolving system functions at runtime.