Sunturai
Back to results
HighMicrosoft Sentinel analyticsThomas McElroy

RunningRAT request parameters

This detection will alert when RunningRAT URI parameters or paths are detect in an HTTP request. Id the device blocked this communication presence of this alert means the RunningRAT implant is likely still executing…

Description

This detection will alert when RunningRAT URI parameters or paths are detect in an HTTP request. Id the device blocked this communication presence of this alert means the RunningRAT implant is likely still executing on the source host.

Detection logic

Detection requirements

Platform
ESXiLinuxmacOSNetwork DevicesWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source product
checkpointfortinetpaloaltonetworkszscaler
Log source service
commonsecuritylog

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice