SloppyRAT/CastleLoader/CastleRAT IOC Hunt — Known Hashes, IPs, Domains
Detects host-based activity or network communication associated with the SloppyRAT remote access trojan. The rule monitors for specific malicious file hashes and connection attempts to known C2 IP addresses and domains.
Microsoft Sentinel (KQL)
