Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Hunting NonEuclid RAT

Steven Lim@KQLWizard

•updated Jul 1, 2025•2•0•39

KQL Query from file: Hunting NonEuclid RAT

Microsoft Sentinel (KQL)

Tags

S0065 - 4H RAT S0379 - Revenge RAT S0066 - 3PARA RAT T1053 - Scheduled Task/Job T1053.005 - Scheduled Task T1053.007 - Container Orchestration Job DS0022 - File T1070.004 - File Deletion T1204.002 - Malicious File T1105 - Ingress Tool Transfer TA0002 - Execution TA0003 - Persistence TA0004 - Privilege Escalation TA0005 - Defense Evasion TA0011 - Command and Control File Creation Scheduled Task Created Windows Windows Eventlog Task Schedulerkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?