Detect PurpleFox Rootkit

Detect PurpleFox Rootkit.

Gh0st RAT payload

Gh0strat

Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

Gh0strat family

PurpleFox

PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

Purplefox family

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.