msaRAT cmd.exe Execution with /e:ON /v:OFF /d /c Flags

Luís Marques@remotecodeexecution

•updated Jul 24, 2026•1•0•2

This rule detects command-line execution patterns associated with msaRAT, specifically targeting cmd.exe launches that utilize the combination of /e:ON, /v:OFF, /d, and /c flags. These flags are used by the RAT to execute commands while suppressing specific command shell configurations and command history, often as part of a covert C2 mechanism.