Detects SiriusRAT

Family: SiriusRAT

SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

Badlisted process makes network request

Network request originating from process or tool commonly abused by malware.

Command and Scripting Interpreter: PowerShell

Run Powershell and hide display window.