BeepRAT ClientInfo System Reconnaissance via HWID Enumeration

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects reconnaissance and C2 registration activity associated with the BeepRAT (DcRAT-derived) malware. The rule correlates registry queries, process execution (e.g., wmic, whoami, systeminfo), and file system activity related to the TCC loader chain, specifically focusing on how the implant gathers system hardware and user information to construct a unique client ID for command and control.