huntrule

Windows File Creation Targeting RAT Client Config Files in Roaming AppData

Alerts on creation of specific RAT client config files under AppData\Roaming on Windows.

FreeUnreviewedSigmahighv1
title: Windows File Creation Targeting RAT Client Config Files in Roaming AppData
id: 4061acc0-2ad2-4a5c-969d-63843870c60f
status: experimental
description: This rule flags Windows file creation events where the target path contains AppData\Roaming and the filename pattern matches specific RAT client configuration names or expected directory variants. Attackers and malware commonly write client configuration files under user profile roaming locations to persistently store operational settings. The detection relies on file event telemetry that includes TargetFilename for newly created files and matches against the specified substrings and suffixes.
references:
  - https://www.virustotal.com/gui/file/c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
  - https://www.virustotal.com/gui/file/e96a0c1bc5f720d7f0a53f72e5bb424163c943c24a437b1065957a79f5872675
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/Generic/file_event_win_malware_generic_creation_configuration_rats.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2024-12-19
tags:
  - attack.execution
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection_required:
    TargetFilename|contains: \AppData\Roaming\
  selection_variants:
    TargetFilename|contains:
      - \mydata\
      - \datalogs\
      - \hvnc\
      - \dcrat\
    TargetFilename|endswith:
      - \datalogs.conf
      - \hvnc.conf
      - \dcrat.conf
  condition: all of selection_*
falsepositives:
  - Legitimate software creating a file with the same name
level: high
license: DRL-1.1
related:
  - id: 2f3039c8-e8fe-43a9-b5cf-dcd424a2522d
    type: derived

What it detects

This rule flags Windows file creation events where the target path contains AppData\Roaming and the filename pattern matches specific RAT client configuration names or expected directory variants. Attackers and malware commonly write client configuration files under user profile roaming locations to persistently store operational settings. The detection relies on file event telemetry that includes TargetFilename for newly created files and matches against the specified substrings and suffixes.

Known false positives

  • Legitimate software creating a file with the same name

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.