SectopRAT: Scheduled Task Spawns Tampered ReportDump.exe Loading Malicious sdkcra.dll
Detects a suspicious execution sequence associated with the SectopRAT loader. The rule monitors for ReportDump.exe being launched from a ProgramData directory by common scheduling or service host processes, followed immediately by the loading of a malicious sdkcra.dll library.
Microsoft Sentinel (KQL)
