BITTER PapRAT and WmRAT Campaign IOC and Behavior Detection
This rule detects activities associated with the BITTER threat group (TA397) campaign involving PapRAT and WmRAT implants. It correlates multiple data sources including process events, network connections, DNS queries, and file activities to identify specific indicators of compromise (IOCs), high-fidelity TTPs such as FTP script execution, obfuscated command lines, scheduled task persistence, C2 communications, and multi-stage chain correlation on Windows devices.
Microsoft Sentinel (KQL)
