LampoRAT Specific Shell Execution

Ethan Andrews@eandrews

•updated May 26, 2026•4•0•156

Detects cmd.exe launched with the exact command line arguments used by LampoRAT (Boggy Serpens) to spawn a shell for payload execution. This specific command line includes '/e:ON', '/v:OFF', '/d', and '/c', which are characteristic of LampoRAT's dispatcher logic.