EtherRAT v7.msi loader download and msiexec execution from camorreado[.]click
Detects the download and execution of the malicious v7.msi installer from the domain camorreado.click. This file acts as a loader for the EtherRAT Node.js RAT, often delivered in the context of fake IT support phishing campaigns. The rule monitors both network connection events to the malicious domain and process creation events involving msiexec.exe execution of the specific MSI payload.
Microsoft Sentinel (KQL)
