Detects DarkSideRAT

Family: DarkSideRAT

DarkSideRAT is a remote access trojan.

Badlisted process makes network request

Network request originating from process or tool commonly abused by malware.

Command and Scripting Interpreter: PowerShell

Run Powershell and hide display window.

Downloads MZ/PE file