CastleRAT Build 120 Persistence Task

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•6

Identifies 'VirtualSmokestGuy120' in process command lines, which is an indicator of CastleRAT Build 120 persistence. This rule specifically looks for a unique string associated with this malware variant's persistence mechanism.