ClickFix/CrashFix Python RAT Strings

Daniel Jeremiah@daniyyell

•updated Feb 11, 2026•0•21

This rule detects Python RATs, specifically looking for strings associated with ModeloRAT or CastleRAT, RC4 encryption, beaconing activity, and checks for domain-joined systems. It also looks for the string 'EncodedCommand' which could indicate PowerShell usage. The rule applies to both PE files (MZ header) and potentially Python scripts (magic number 0x0A0D0D0A with 'python' string).