Xtreme RAT

Hunt Hypothesis

This detection rule identifies the presence of Xtreme Remote Access Trojan (RAT) malware, which adversaries deploy to establish persistent command-and-control channels and execute remote actions on compromised endpoints. The SOC team should proactively hunt for this behavior in Azure Sentinel because early identification of low-severity RAT activity can prevent lateral movement and data exfiltration before the threat escalates into a critical incident.

YARA Rule

rule Xtreme
{
    meta:
        description = "Xtreme RAT"
	author = "botherder https://github.com/botherder"

    strings:
        $string1 = /(X)tremeKeylogger/ wide ascii
        $string2 = /(X)tremeRAT/ wide ascii
        $string3 = /(X)TREMEUPDATE/ wide ascii
        $string4 = /(S)TUBXTREMEINJECTED/ wide ascii

        $unit1 = /(U)nitConfigs/ wide ascii
        $unit2 = /(U)nitGetServer/ wide ascii
        $unit3 = /(U)nitKeylogger/ wide ascii
        $unit4 = /(U)nitCryptString/ wide ascii
        $unit5 = /(U)nitInstallServer/ wide ascii
        $unit6 = /(U)nitInjectServer/ wide ascii
        $unit7 = /(U)nitBinder/ wide ascii
        $unit8 = /(U)nitInjectProcess/ wide ascii

    condition:
        5 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 12 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Xtreme RAT detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Management Agent Updates (e.g., Ivanti or SCCM)

  • Scenario: The Xtreme RAT often mimics legitimate endpoint management traffic. When tools like Ivanti Endpoint Manager or Microsoft System Center Configuration Manager (SCCM) push software updates or configuration changes, they may spawn processes that establish outbound connections to known update servers and inject code into running sessions, triggering the “RAT activity” signature.
  • Filter/Exclusion: Exclude traffic originating from specific management server IP ranges (e.g., 10.50.20.0/24) or whitelist the specific executable hashes of the agent binaries (IvantiAgent.exe, ccmexec.exe) performing these scheduled update tasks between 02:00 and 06:00 UTC.

• IT Helpdesk Remote Support Sessions

  • Scenario: During active support tickets, IT administrators use remote control tools like TeamViewer, AnyDesk, or LogMeIn Pro. These applications inherently possess RAT-like capabilities (screen capture, file transfer, command execution) and often run as background services. A sudden session initiation by a known helpdesk user account can be flagged as suspicious RAT behavior if the baseline does not account for these specific service accounts.
  • Filter/Exclusion: Create an exclusion rule that suppresses alerts when the source process matches known remote support executables (TeamViewer_Service.exe, AnyDesk.exe) and the initiating user belongs to the IT-Support-Admins AD security group.

• Automated Patching and Compliance Scans

  • Scenario: Scheduled compliance scanners such as Qualys Cloud Agent, Tenable Nessus Agents,