COLDSTEEL

COLDSTEEL Persistence Service Creation

Nov 10, 2026 · attack.persistence detection.emerging-threats attack.stealth ·

Detects the creation of new services potentially related to COLDSTEEL RAT

COLDSTEEL RAT Anonymous User Process Execution

Nov 10, 2026 · attack.persistence detection.emerging-threats attack.stealth ·

Detects the creation of a process executing as user called "ANONYMOUS" seen used by the "MileStone2016" variant of COLDSTEEL

COLDSTEEL RAT Cleanup Command Execution

Nov 10, 2026 · attack.persistence detection.emerging-threats attack.stealth ·

Share on:

Detects the creation of a "rundll32" process from the ColdSteel persistence service to initiate the cleanup command by calling one of its own exports. This functionality is not present in "MileStone2017" and some "MileStone2016" samples

COLDSTEEL RAT Service Persistence Execution

Nov 10, 2026 · attack.persistence detection.emerging-threats attack.stealth ·

Share on:

Detects the creation of an "svchost" process with specific command line flags, that were seen present and used by ColdSteel RAT

Potential COLDSTEEL Persistence Service DLL Creation

Nov 10, 2026 · attack.persistence detection.emerging-threats attack.stealth ·

Share on:

Detects the creation of a file in a specific location and with a specific name related to COLDSTEEL RAT

Potential COLDSTEEL Persistence Service DLL Load

Nov 10, 2026 · attack.persistence detection.emerging-threats attack.stealth ·

Share on:

Detects a suspicious DLL load by an "svchost" process based on location and name that might be related to ColdSteel RAT. This DLL location and name has been seen used by ColdSteel as the service DLL for its persistence mechanism

Potential COLDSTEEL RAT File Indicators

Nov 10, 2026 · attack.persistence detection.emerging-threats attack.stealth ·

Share on:

Detects the creation of a file named "dllhost.exe" in the "C:\users\public\Documents" directory. Seen being used by the COLDSTEEL RAT in some of its variants.

Potential COLDSTEEL RAT Windows User Creation

Nov 10, 2026 · attack.persistence detection.emerging-threats ·

Share on:

Detects creation of a new user profile with a specific username, seen being used by some variants of the COLDSTEEL RAT.