COLDSTEEL RAT Persistence via newdev.dll Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

Detects the creation of a file named 'newdev.dll' in a user's AppData\Roaming directory. This specific file path and name are associated with the COLDSTEEL Remote Access Trojan (RAT) for persistence.