Sauron Loader rnpkeys.exe spawns follow-on payload execution

Ibrahim Saud@tektrix

•updated Sep 26, 2026•1•0•3

Detects instances where 'rnpkeys.exe', residing within a 'keyroll' directory, initiates suspicious child processes or executes suspicious command lines. This includes triggering common scripting engines like PowerShell or cmd.exe, using execution policy bypass flags, or executing binaries from Temp directories, which are characteristic of malicious post-exploitation or persistence activities.