BeepRAT Obfuscated .NET Assembly with Base64-Encoded Strings at Runtime
Detects the execution of BeepRAT, a RAT derived from DcRAT, which utilizes heavy obfuscation of class names and Base64-encoded strings that are decoded at runtime. The rule monitors command-line arguments for specific obfuscated identifier patterns and encoded strings associated with the malware's operation, while excluding files located in standard Windows or Program Files directories.
Sigma
