ModeloRAT configA.json Drop by Python
Detects the creation of 'configA.json' by a Python process, which indicates successful host profiling by KongTuke's ModeloRAT reconnaissance module. This file is typically dropped after the reconnaissance phase to store collected system information.
Microsoft Sentinel (KQL)
