CastleRAT Generic Persistence Task

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•5

Identifies the creation or execution of a 'VirtualSmokestGuy' scheduled task, which is associated with CastleRAT for persistence. The rule specifically looks for command-line activity containing 'VirtualSmokestGuy' and excludes specific numerical strings to reduce false positives.