BeepRAT AMSI/ETW/WLDP Bypass via TCC or LuaJIT Shellcode Loader
Detects execution of potential BeepRAT loaders such as tcc.exe, luajit.exe, or hfy.exe that exhibit evasive behavior by loading amsi.dll. This activity is indicative of in-memory shellcode execution attempting to disable security features like AMSI, ETW, or WLDP before loading malicious payloads.
Microsoft Sentinel (KQL)
