Potential CSharp Streamer RAT .NET Executable Image Load

SigmaHQ Detections@sigmaHQ

•updated Jun 13, 2025•0•21

Detects potential CSharp Streamer RAT loading a .NET executable image by identifying a specific file name pattern and path commonly associated with the tool. This rule looks for image loads from a temporary directory with a filename matching 'dat[0-9A-Z]{4}\.tmp'.