Date: 08/02/2024
Severity: High
Summary
Identifies potential CSharp Streamer RAT by checking for a .NET executable with the default file name and path linked to the tool.
Indicators of Compromise (IOC) List
ImageLoaded | \\AppData\\Local\\Temp\\dat[0-9A-Z]{4}\.tmp |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 | resourcename = "Sysmon" and eventtype = "7" and (imageloaded like "\\AppData\\Local\\Temp\\dat[0-9A-Z]{4}\.tmp") |
Detection Query 2 | resourcename = "EDR" and (imageloaded like "\\AppData\\Local\\Temp\\dat[0-9A-Z]{4}\.tmp") |
Category: Sigma
Reference:
Sigma Detection Rule for CSharp Streamer .NET Image Loading
The DFIR Report Analysis of IcedID, CSharp Streamer, and ALPHV Ransomware
Cyber.wtf Technical Analysis of the CSharp Streamer RAT