All Detections

Regasm Executing Text File Payload

avatar
Ethan Andrews@eandrews
updated May 6, 202650257

Identifies regasm.exe executing a payload disguised as a .txt file, a technique observed in CloudZ RAT intrusions to proxy the execution of its .NET loader.

Microsoft Sentinel (KQL)