NarwhalRAT Xcopy USB Data Staging

Kaung Khant Ko@kaungkhantko

•updated Jun 15, 2026•2•0•6

Detects the specific xcopy command-line arguments used by APT37 NarwhalRAT to silently copy data from removable drives to a local temporary path. This rule identifies the use of xcopy.exe with a combination of flags (/s, /e, /y, /c, /q, /h, /b) that are characteristic of NarwhalRAT's data staging activities from removable media.