COLDSTEEL RAT Cleanup Command Execution
Detects the execution of 'rundll32.exe' by a 'svchost.exe' process, specifically when the 'svchost.exe' is running with command-line arguments associated with the ColdSteel RAT persistence mechanism (e.g., '-k msupdate', '-k msupdate2', '-k alg'). The 'rundll32.exe' process further executes specific functions ('UpdateDriverForPlugAndPlayDevicesW', 'ServiceMain', 'DiUninstallDevice') which are indicative of the ColdSteel RAT's cleanup or operational commands. This behavior is noted to be specific to certain ColdSteel RAT samples and not present in older versions.
Sigma
