Moonrise RAT Execution or Reference
This rule detects the execution or referencing of files named 'moonrise-client.exe', 'moonrise.exe', or 'moonriseclient.exe'. These filenames are associated with the Moonrise RAT, indicating potential malware activity on the system. The rule specifically looks for these filenames in the process's file name or command line arguments.
Microsoft Sentinel (KQL)
