Renamed Remote Utilities (RURAT) Execution via PE Header Product Field
This rule detects the execution of the Remote Utilities (RURAT) legitimate remote administration tool when its executable name has been changed from its default names (rutserv.exe or rfusclient.exe). It identifies the tool by inspecting the 'Product' field in the PE header, which contains 'Remote Utilities', and then filters out the known legitimate executable names to catch instances where the file has been renamed, often as a defense evasion technique.
Sigma
