Windows CSharp Streamer RAT Potentially Loaded .NET Executable from Temp dat####.tmp
Identifies .NET executable image loads from a CSharp Streamer RAT-like Temp .tmp path pattern on Windows.
- Product
- windows
- Category
- image_load
- Author
- Luca Di Bartolomeo (SigmaHQ), DRL 1.1
- Published
- 2024-06-22
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows image loads where the loaded file path matches the default Temp naming pattern dat####.tmp (\AppData\Local\Temp\dat[0-9A-Z]{4}\.tmp). Such behavior matters because RAT-style tooling may stage and execute .NET payloads from transient locations to evade simpler allowlists. The detection relies on image_load telemetry capturing the full ImageLoaded path that matches this specific Temp pattern.
Reporting behind it
- thedfirreport.comhttps://thedfirreport.com/2024/06/10/icedid-brings-screenconnect-and-csharp-streamer-to-alphv-ransomware-deployment/#detections
- cyber.wtfhttps://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/CSharp-Streamer/image_load_malware_csharp_streamer_dotnet_load.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows CSharp Streamer RAT Potentially Loaded .NET Executable from Temp dat####.tmp
id: 6a1098dc-d52e-4834-ab51-2d41712d9e8c
status: test
description: This rule flags Windows image loads where the loaded file path matches the default Temp naming pattern dat####.tmp (\AppData\Local\Temp\dat[0-9A-Z]{4}\.tmp). Such behavior matters because RAT-style tooling may stage and execute .NET payloads from transient locations to evade simpler allowlists. The detection relies on image_load telemetry capturing the full ImageLoaded path that matches this specific Temp pattern.
references:
- https://thedfirreport.com/2024/06/10/icedid-brings-screenconnect-and-csharp-streamer-to-alphv-ransomware-deployment/#detections
- https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/CSharp-Streamer/image_load_malware_csharp_streamer_dotnet_load.yml
author: Luca Di Bartolomeo, Huntrule Team
date: 2024-06-22
tags:
- attack.command-and-control
- attack.t1219.002
- detection.emerging-threats
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded|re: \\AppData\\Local\\Temp\\dat[0-9A-Z]{4}\.tmp
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 6f6afac3-8e7a-4e4b-9588-2608ffe08f82
type: derived