Detects SiriusRAT

Family: SiriusRAT

SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.

Detect binaries embedding considerable number of MFA browser extension IDs.

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

Detects command variations typically used by ransomware

Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables referencing many Password Manager software clients. Observed in infostealers

Detects executables referencing many email and collaboration clients. Observed in information steale

Uses Session Manager for persistence

Creates Session Manager registry key to run executable early in system boot.