T1219 Remote Access Tools - QuimaRAT IoCs
These are extracted IoCs from a QuimaRAT sample I tore apart on my personal blog, found in the resources linked below. This is just one of many samples, so while it is certainly not all encompassing pertaining to all QuimaRAT activity, it does a great job serving as a starting point. As you will read in my analysis, QuimaRAT relies on a config file created that allows for many parameters to be changed. I did my best to focus on high-fidelity IoCs and not rely on any easily modified values in the configuration file.
Microsoft Sentinel (KQL)
