← Back to SOC feed Coverage →

xtreme rat 0

yara LOW Yara-Rules
backdoorcommunity
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-14T23:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies potential Xtreme RAT activity by monitoring for specific file execution patterns defined in the xtreme_rat_0 YARA signature within Azure Sentinel workloads. Proactively hunting for this behavior is critical because early identification of low-severity RAT indicators allows SOC teams to investigate lateral movement and data exfiltration attempts before they escalate into significant security incidents.

YARA Rule

rule xtreme_rat_0
{ 
	meta:
		maltype = "Xtreme RAT"
		reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/xtreme-rat-targets-israeli-government/"
	strings:
		$type="Microsoft-Windows-Security-Auditing"
		$eventid="5156"
		$data="windows\\system32\\sethc.exe"

		$type1="Microsoft-Windows-Security-Auditing"
		$eventid1="4688"
		$data1="AppData\\Local\\Temp\\Microsoft Word.exe"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 6 string patterns in its detection logic.

References

False Positive Guidance

Here are specific false positive scenarios for the xtreme_rat_0 detection rule in an enterprise environment, along with recommended filters or exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/RAT_Xtreme.yar