AsyncRAT APC Injection Targeting Explorer.exe
This rule detects potential APC injection techniques targeting explorer.exe, often associated with AsyncRAT. It looks for combinations of process injection API calls (QueueUserAPC, NtQueueApcThread, NtQueueApcThreadEx, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, NtCreateThreadEx) in conjunction with explorer.exe. Additionally, it includes a pattern to detect python.exe interacting with explorer.exe, which could indicate a multi-stage attack involving Python-based components.
YARA
