ShadowTech RAT

Hunt Hypothesis

This detection rule identifies the presence of the ShadowTech Remote Access Trojan (RAT) by monitoring for its specific behavioral indicators within the Azure Sentinel environment. Proactive hunting is essential to uncover silent infections that may evade standard signature-based alerts, ensuring early containment before adversaries establish persistent command and control channels.

YARA Rule

rule ShadowTech_2
{
    meta:
        description = "ShadowTech RAT"
	author = "botherder https://github.com/botherder"

    strings:
        $string1 = /\#(S)trings/
        $string2 = /\#(G)UID/
        $string3 = /\#(B)lob/
        $string4 = /(S)hadowTech Rat\.exe/
        $string5 = /(S)hadowTech_Rat/

    condition:
        all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ShadowTech RAT detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Management Software Updates

  • Scenario: The deployment of remote administration agents (such as Microsoft Endpoint Configuration Manager (SCCM) or Ivanti Neurons) often triggers the rule when they push critical security patches or perform inventory scans. These tools utilize legitimate Remote Access Technologies (RAT) protocols to establish persistent connections with endpoints, mimicking the behavior of unauthorized RATs.
  • Filter/Exclusion: Create an exclusion for process execution originating from known management binaries (e.g., ccmexec.exe, ivanti_agent.exe) running under the SYSTEM or dedicated service accounts (svc-scmmgmt). Additionally, filter out network connections where the destination IP belongs to the internal enterprise management subnet.

• Scheduled Administrative Maintenance Jobs

  • Scenario: Automated scheduled tasks executed by IT operations teams using tools like Ansible, PowerShell Remoting (WinRM), or SolarWinds NPM. These jobs frequently run during off-hours (e.g., 02:00 – 04:00 UTC) to perform remote configuration changes, log collection, or backup verification. The rule may flag the high-volume data exfiltration and command execution associated with these routine maintenance windows as suspicious RAT activity.
  • Filter/Exclusion: Implement a time-based exclusion window for alerts generated between 01:00 and 05:00 local time on weekdays, provided the source user is a known service account (e.g., svc-automation, admin-backup). Furthermore, exclude traffic where the destination port matches standard management ports (e.g., TCP 5985/5986 for WinRM) and the source process hash matches the approved Ans