Multi-stage payload download from signindat.com with generic User-Agent

Duo Tech@duotech

•updated Jul 9, 2026•0•0•1

Detects HTTP GET requests to signindat.com for suspected malicious payloads, including executables (.exe) and scripts (.ps1), as well as a decoy PDF document. The rule identifies communication with an external host using generic User-Agent strings, characteristic of the CrySome RAT multi-stage download process.