In-memory PureRAT loader chain via CryptoLoader/PsStealer/Net.loader stages

Duo Tech@duotech

•updated Jul 15, 2026•6•0•8

This rule monitors process execution events for activity related to known malware families (CryptoLoader, PsStealer, Net.loader, PureRAT) or processes executed from '_MEI' temporary directories. It aggregates events within a 15-minute window per device and user, alerting when two or more distinct processes are identified, which is indicative of malware staging or execution chains.