BeepRAT TCC-based In-Memory Shellcode with AMSI/ETW/WLDP Bypass
Detects the use of the Tiny C Compiler (TCC) to compile or execute shellcode associated with BeepRAT malware. The rule monitors for characteristic TCC command line arguments ('-nostdlib', '-run') and specific file names ('temp.bin', 'config.ini.c') within the TCC deployment path that are indicative of staging and executing malicious code while attempting to bypass defensive mechanisms like AMSI, ETW, and WLDP.
Microsoft Sentinel (KQL)
