Yellow Cockatoo RAT Patterns

Danny Y@zendannyy

•updated Feb 17, 2026•1•0•64

This rule detects patterns associated with the Yellow Cockatoo RAT, specifically looking for process creation events where an interpreter is executed with command-line arguments containing both XOR encoding indicators and references to shortcut files ('.lnk') for potential persistence or execution.