Disguised .NET Payload Loading via Manifest (AsyncRAT)

Ibrahim Saud@tektrix

•updated Jun 18, 2026•2•0•44

This rule detects the execution of PowerShell or AutoHotkey processes that include 'RtkLoggingManifest.man' in their command line. This behavior is indicative of AsyncRAT attempting to reconstruct a hidden .NET executable payload by parsing integers from a fake manifest file.