BeepRAT Lua FFI Shellcode Injection via tcc.exe and temp.bin
This rule detects suspicious activity associated with the BeepRAT malware loader chain. It monitors for the execution of TCC.exe (a common name for Tiny C Compiler used by some malwares for dynamic compilation) with specific command-line arguments like -nostdlib and -run, as well as the spawning of suspicious child processes (cmd.exe, powershell.exe, or conhost.exe) by TCC.exe or the presence of a temp.bin file in the command line, which is indicative of BeepRAT shellcode loading behavior.
Splunk (SPL)
