huntrule

Antivirus Remote Access Tool Signature Matches Known RAT Names

Alerts on antivirus detections referencing multiple known RAT family signature names in the event signature field.

FreeReviewedSigma · Critical · v5
Category
antivirus
Author
Arnim Rupp (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2026-06-15
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags antivirus alerts where the signature text contains names of known remote access tools and RAT families. Such matches are important because RAT-related malware is commonly used for command-and-control and remote control of compromised systems, even when antivirus has blocked the payload. The detection relies on antivirus alert telemetry that includes a signature field containing the specified tool names.

Reporting behind it

Related detections9 linkedT1219 — drag to rearrange
Antivirus signatures matching APT malware naming patterns
Antivirus signature match for exploitation framework indicators
Suspicious AnyDesk Unattended Access Configuration via Command Line (via process_creation)
Suspicious NetSupport client32 Persistence via Run Key from ProgramData
Suspicious Atera Agent Silent Onboarding via Process Creation
Suspicious Remote Access Tool User Agent in Outbound Traffic via Proxy
Suspicious ScreenConnect Remote Access Binary Running Under a Renamed Executable
Malicious Silent AteraAgent RMM Installation via IntegratorLogin
Possible Remote Monitoring and Management Tool Abuse for Remote Access
Antivirus Remote Access Tool Signature Matches Known RAT Names
Pivot detection · T1219 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.