KNTRAT kntrat-prefixed named pipes and cmd.exe child of masqueraded conhost.exe
Detects indicators associated with the KNTRAT implant, including the creation of named pipes containing the 'kntrat' prefix and the execution of cmd.exe spawned by a conhost.exe instance running outside of legitimate Windows system directories.
Microsoft Sentinel (KQL)
