msaRAT cmd.exe execution via non-standard /e:ON /v:OFF /d /c flags

Ethan Andrews@eandrews

•updated Jul 23, 2026•7•0•10

Detects the invocation of cmd.exe using the specific non-standard flag combination '/e:ON /v:OFF /d /c'. This command pattern is associated with the msaRAT implant, which leverages these flags to execute commands received via browser-mediated C2 channels (WebRTC/CDP).