Windows: RURAT (Remote Utilities) Executed From Unusual Path
Alerts on Remote Utilities RURAT executables running outside the typical Program Files install paths on Windows.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-19
- Updated
- 2026-07-30
What it detects
This rule flags process creation where Remote Utilities client binaries associated with RURAT (rutserv.exe and rfusclient.exe) are launched from locations other than the standard Remote Utilities installation directories under Program Files. Attackers may run RAT components from non-default paths to reduce exposure, blend in with other files, or persist after installation. The detection relies on Windows process creation telemetry, matching executable paths and applying exclusions for the expected installation locations.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: RURAT (Remote Utilities) Executed From Unusual Path"
id: a8e8d104-d941-4661-8693-ab1a681b5a5d
status: test
description: This rule flags process creation where Remote Utilities client binaries associated with RURAT (rutserv.exe and rfusclient.exe) are launched from locations other than the standard Remote Utilities installation directories under Program Files. Attackers may run RAT components from non-default paths to reduce exposure, blend in with other files, or persist after installation. The detection relies on Windows process creation telemetry, matching executable paths and applying exclusions for the expected installation locations.
references:
- https://redcanary.com/blog/misbehaving-rats/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_rurat_non_default_location.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-19
modified: 2023-03-05
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith:
- \rutserv.exe
- \rfusclient.exe
- Product: Remote Utilities
filter:
Image|startswith:
- C:\Program Files\Remote Utilities
- C:\Program Files (x86)\Remote Utilities
condition: selection and not filter
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: e01fa958-6893-41d4-ae03-182477c5e77d
type: derived