Chaos Ransomware - Masqueraded MSI Installer Execution
Detects msiexec.exe executing an MSI package named update_ms.msi staged in ProgramData. Chaos ransomware disguises this installer's properties and filename to impersonate a legitimate Windows Update package. On execution, a custom action (CA_Run_EA2AEBC3) loads an embedded DLL (Bin_lib_EA2AEBC3, lib.dll) directly into memory, deploying the msaRAT payload. This rule sees the installer execution only; the in-memory module load is not observed here and would need a separate PROCESS_MODULE_LOAD rule.
YARA-L
