SloppyRAT Hell's Gate DLL Load (Indirect Syscall/DJB2 Hashing)
Detects the loading or execution of known SloppyRAT DLL samples. This malware is identified for its implementation of Hell's Gate-style indirect syscalls, utilizing techniques such as DJB2 API hashing and NTDLL stub parsing to evade EDR hooks. The rule monitors for specific file hashes and potential masquerading behaviors (e.g., hostfxr.dll) across image loading, file, and process events.
Microsoft Sentinel (KQL)
