PlugX RAT Privilege Escalation Attempt via Side-loaded Process

Kaung Khant Ko@kaungkhantko

•updated Sep 19, 2026•1•0•4

This rule detects known side-loaded PlugX RAT host processes ('GRrte.exe' or 'Jarte.exe') located in 'JartePortable' directories attempting to modify process tokens or privileges. This behavior is indicative of privilege escalation preparation, a common activity for the PlugX modular RAT.