SectopRAT-style C2 shell/process command after outbound beacon from ReportDump.e

Arnold Chan@slaz

•updated Sep 25, 2026•0•0•1

Detects anomalous post-exploitation behavior associated with SectopRAT, where a suspicious process (e.g., ReportDump.exe) establishes a persistent network connection to a known C2 IP address followed closely by the invocation of common command-line utilities (cmd, powershell, tasklist, etc.) used for file and process management.