SectopRAT: ReportDump.exe C2 Connection Followed by Screen-Capture DLL Loads
Detects the ReportDump.exe process initiating a network connection on port 15847 followed by the loading of GDI/User32 libraries shortly thereafter. This behavior is indicative of SectopRAT establishing a command-and-control channel and initializing screen capture capabilities.
Microsoft Sentinel (KQL)
