Windows: RURAT (Remote Utilities) Executed From Unusual Path

title: "Windows: RURAT (Remote Utilities) Executed From Unusual Path"
id: a8e8d104-d941-4661-8693-ab1a681b5a5d
status: test
description: This rule flags process creation where Remote Utilities client binaries associated with RURAT (rutserv.exe and rfusclient.exe) are launched from locations other than the standard Remote Utilities installation directories under Program Files. Attackers may run RAT components from non-default paths to reduce exposure, blend in with other files, or persist after installation. The detection relies on Windows process creation telemetry, matching executable paths and applying exclusions for the expected installation locations.
references:
  - https://redcanary.com/blog/misbehaving-rats/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_rurat_non_default_location.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-19
modified: 2023-03-05
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith:
        - \rutserv.exe
        - \rfusclient.exe
    - Product: Remote Utilities
  filter:
    Image|startswith:
      - C:\Program Files\Remote Utilities
      - C:\Program Files (x86)\Remote Utilities
  condition: selection and not filter
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: e01fa958-6893-41d4-ae03-182477c5e77d
    type: derived