Moonrise RAT - Go Binary Persistence via Run Key or Startup Folder

Ethan Andrews@eandrews

•updated Feb 28, 2026•4•0•69

This rule detects when a process, potentially a Go-compiled binary (indicated by 'go' in the command line), establishes persistence by creating or modifying a registry run key or by dropping a file in a startup folder. This behavior is associated with the Moonrise RAT.