All Detections

EtherRAT Config File Creation

avatar
Ibrahim Saud@tektrix
updated Jun 17, 20260013

Detects the creation of EtherRAT's hidden configuration file '.node_bot_id' within the AppData folder. This file is indicative of EtherRAT malware activity.

Microsoft Sentinel (KQL)