APT36 RUSTYSHADE backdoor execution (DriverInstaller.exe)

Ibrahim Saud@tektrix

•updated Sep 20, 2026•1•0•3

This rule detects the execution of 'DriverInstaller.exe' (either by filename or a known malicious SHA256 hash) that subsequently initiates network connections to GitHub domains. This behavior is indicative of potential malicious activity, such as downloading secondary payloads, command-and-control communication, or beaconing from a suspected rogue or masquerading driver installation utility.