FormBook RAT Loader via Scripting Interpreters

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•1

Detects the execution of processes with command lines containing keywords associated with FormBook RAT, initiated by common scripting interpreters like PowerShell, cmd, or wscript. This rule aims to identify potential FormBook RAT loader activity.