CDP Runtime.evaluate injects WebRTC PeerConnection JavaScript (msaRAT)

Emiliano Mema@Nosalva

•updated Aug 20, 2026•0•0•5

This rule detects browser-based runtime evaluations that utilize WebRTC's RTCPeerConnection and createDataChannel APIs, often indicative of an adversary attempting to establish a covert command-and-control (C2) channel directly from a compromised browser session.