Remote Utilities RAT Execution From Unusual Location
This rule detects the execution of Remote Utilities RAT (RURAT) executables (`rutserv.exe` or `rfusclient.exe`) or any process with 'Remote Utilities' in its product name, when they are launched from an unusual location, specifically outside of the standard 'C:\Program Files\Remote Utilities' or 'C:\Program Files (x86)\Remote Utilities' directories. This behavior can indicate an attempt to evade detection or establish persistence by placing the RAT in a non-standard path.
Sigma
