BeepRAT HWID Fingerprinting via MD5 of System Attributes
This rule detects potential BeepRat malware activity by monitoring for specific file names associated with the threat, combined with reconnaissance behaviors. The rule identifies processes performing system information discovery, specifically machine identification (GetHWID), hardware metrics (ProcessorCount, DriveInfo), and cryptographic operations (MD5CryptoServiceProvider) which are commonly used in the initial stages of malware execution to profile target systems.
Splunk (SPL)
