All Detections

AsyncRAT - RijndaelManaged ECB Crypto Setup

avatar
Ibrahim Saud@tektrix
updated Jun 20, 2026008

Hunts for PowerShell commands setting up the RijndaelManaged API in ECB mode, a cryptographic pattern used by AsyncRAT for C2 packet encryption.

Microsoft Sentinel (KQL)