hightestEmerging Threat
Potential COLDSTEEL RAT Windows User Creation
Detects creation of a new user profile with a specific username, seen being used by some variants of the COLDSTEEL RAT.
windowsregistry_set
2023-08-17
Emerging Threats
Malware2023
COLDSTEEL
8Rules
1References
1Folders
2023-08-17Latest
Summary
COLDSTEEL is tracked here as a malware family or toolset with 8 Sigma detections spanning 2023. Coverage centers on windows / process_creation, windows / file_event, windows / image_load +2.
Related Detections
Search this threathightestEmerging Threat
COLDSTEEL Persistence Service Creation
Detects the creation of new services potentially related to COLDSTEEL RAT
windowssystem
2023-05-02
hightestEmerging Threat
Potential COLDSTEEL Persistence Service DLL Load
Detects a suspicious DLL load by an "svchost" process based on location and name that might be related to ColdSteel RAT. This DLL location and name has been seen used by ColdSteel as the service DLL for its persistence mechanism
windowsimage_load
2023-05-02
hightestEmerging Threat
COLDSTEEL RAT Anonymous User Process Execution
Detects the creation of a process executing as user called "ANONYMOUS" seen used by the "MileStone2016" variant of COLDSTEEL
windowsprocess_creation
2023-04-30
criticaltestEmerging Threat
COLDSTEEL RAT Cleanup Command Execution
Detects the creation of a "rundll32" process from the ColdSteel persistence service to initiate the cleanup command by calling one of its own exports. This functionality is not present in "MileStone2017" and some "MileStone2016" samples
windowsprocess_creation
2023-04-30
References