Modifies WinLogon for persistence

Modifies visiblity of hidden/system files in Explorer

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

WarzoneRat, AveMaria

WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

Warzonerat family

Warzone RAT payload

Boot or Logon Autostart Execution: Active Setup

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.