File Creation Related To RAT Clients
This rule detects the creation of specific configuration files (`.conf`) in the `AppData\Roaming` directory, which have been observed in the wild to be associated with Remote Access Trojans (RATs) such as VenomRAT, AsyncRAT, and Lumma Stealer. The rule looks for files ending with `datalogs.conf`, `hvnc.conf`, or `dcrat.conf` within subdirectories like `mydata`, `datalogs`, `hvnc`, or `dcrat` under `AppData\Roaming`.
Sigma
