AsyncRAT Batch File Activity Detection
This rule detects batch files associated with an AsyncRAT campaign. It identifies specific batch file names, PowerShell commands used for downloading malicious content, Python installation paths, and persistence mechanisms leveraging the Windows Startup folder. The rule looks for a combination of these indicators, such as specific batch file names, PowerShell download commands with output files, Python installation paths, or batch file names combined with startup folder persistence paths.
YARA
