KongTuke ModeloRAT PowerShell Dropper Execution

Brandon Rodriguez@BMRodriguez

•updated May 20, 2026•1•0•152

Detects the initial PowerShell command users are instructed to paste and run from the Windows Run dialog following a Microsoft Teams social engineering lure to deploy ModeloRAT. This rule specifically looks for PowerShell execution that downloads content from 'dropbox.com' using 'iwr' (Invoke-WebRequest), extracts an archive using 'Expand-Archive', and targets the 'appdata' directory.