Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
2
1
Categories
3
Platforms
3
Products / Services
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
Detects execution of renamed Remote Utilities (RURAT) via Product PE header field
Detects execution of renamed Remote Utilities (RURAT) via Product PE header field
This rule detects the execution of the Remote Utilities (RURAT) legitimate remote administration tool when its executable name has been changed from its default names (rutserv.exe or rfusclient.exe). It identifies the tool by inspecting the 'Product' field in the PE header, which contains 'Remote Utilities', and then filters out the known legitimate executable names to catch instances where the file has been renamed, often as a defense evasion technique.