Potential CSharp Streamer RAT .NET Image Loaded from Temp .tmp Path (Windows)

title: Potential CSharp Streamer RAT .NET Image Loaded from Temp .tmp Path (Windows)
id: 6a1098dc-d52e-4834-ab51-2d41712d9e8c
status: test
description: This rule flags Windows image-load events where the loaded file path matches the default Temp location pattern ending with a .tmp file. Attackers may stage and execute .NET payloads from ephemeral directories to evade static analysis and blend into normal file activity. The detection relies on image_load telemetry that records the full ImageLoaded path and applies a filename/path regex match for the specific Temp pattern.
references:
  - https://thedfirreport.com/2024/06/10/icedid-brings-screenconnect-and-csharp-streamer-to-alphv-ransomware-deployment/#detections
  - https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/CSharp-Streamer/image_load_malware_csharp_streamer_dotnet_load.yml
author: Luca Di Bartolomeo, Huntrule Team
date: 2024-06-22
tags:
  - attack.command-and-control
  - attack.t1219.002
  - detection.emerging-threats
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|re: \\AppData\\Local\\Temp\\dat[0-9A-Z]{4}\.tmp
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 6f6afac3-8e7a-4e4b-9588-2608ffe08f82
    type: derived