COLDSTEEL RAT Service Creation for Persistence

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

Detects the creation of new Windows services with specific names ('Name', 'msupdate', 'msupdate2') and an ImagePath containing '\Windows\System32\svchost.exe'. This pattern is associated with the COLDSTEEL RAT for persistence.