NETRYX RAT DeviceSync.exe spawning cmd.exe /c shell commands
Detects the NETRYX RAT shell handler (DeviceSync.exe) spawning cmd.exe with the /c parameter to execute operator-supplied commands, excluding legitimate application paths in Program Files and Windows directories.
Microsoft Sentinel (KQL)
