Fileless .NET load via pool.db read + CLR init (SectopRAT)

Ankit Mehta@Secvyn

•updated 6 days ago•0•0•0

This rule detects the suspicious pattern of a process reading a 'pool.db' file followed immediately by the loading of .NET Common Language Runtime (CLR) modules (clr.dll or mscoreei.dll). This behavior is characteristic of fileless execution chains where a secondary payload is retrieved and executed directly in memory.