COLDSTEEL

COLDSTEEL Persistence Service Creation

Aug 12, 2024 · attack.defense-evasion attack.persistence detection.emerging-threats ·

Detects the creation of new services potentially related to COLDSTEEL RAT

COLDSTEEL RAT Anonymous User Process Execution

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·

Detects the creation of a process executing as user called "ANONYMOUS" seen used by the "MileStone2016" variant of COLDSTEEL

COLDSTEEL RAT Cleanup Command Execution

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·

Share on:

Detects the creation of a "rundll32" process from the ColdSteel persistence service to initiate the cleanup command by calling one of its own exports. This functionality is not present in "MileStone2017" and some "MileStone2016" samples

COLDSTEEL RAT Service Persistence Execution

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·

Share on:

Detects the creation of an "svchost" process with specific command line flags, that were seen present and used by ColdSteel RAT

Potential COLDSTEEL Persistence Service DLL Creation

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·

Share on:

Detects the creation of a file in a specific location and with a specific name related to COLDSTEEL RAT

Potential COLDSTEEL Persistence Service DLL Load

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·

Share on:

Detects a suspicious DLL load by an "svchost" process based on location and name that might be related to ColdSteel RAT. This DLL location and name has been seen used by ColdSteel as the service DLL for its persistence mechanism

Potential COLDSTEEL RAT File Indicators

Aug 12, 2024 · attack.persistence attack.defense-evasion detection.emerging-threats ·

Share on:

Detects the creation of a file named "dllhost.exe" in the "C:\users\public\Documents" directory. Seen being used by the COLDSTEEL RAT in some of its variants.

Potential COLDSTEEL RAT Windows User Creation

Aug 12, 2024 · attack.persistence detection.emerging-threats ·

Share on:

Detects creation of a new user profile with a specific username, seen being used by some variants of the COLDSTEEL RAT.