CDP Runtime.addBinding used to register msaRAT covert IPC binding names

Emiliano Mema@Nosalva

•updated Aug 20, 2026•0•0•0

This rule monitors DeviceEvents for the presence of the 'Runtime.addBinding' JavaScript interface within process creation or network inspection logs. This pattern is commonly associated with WebView-based applications exposing internal browser-side objects to the web content, which can potentially be exploited for remote code execution or cross-site scripting (XSS) if not implemented with strict security constraints.