Castle-RAT Distribution
CastleRAT is a lightweight remote access trojan (RAT) that was observed as a payload in campaigns leveraging CastleLoader malware. Originally this payload was discovered and coined PyNightshade which was seen being delivered via campaigns leveraging ClickFix for initial access to victims.
Our research into the threat has produced the following security outcomes to proactively improve your defence against this threat.
Community Detection Opportunities
Detection Opportunity (KQL) 1
//CastleLoader and CastleRAT - Commandline Detections
// TAG150
// Detects the execution of 'schtasks.exe' being used to create a new task where the task payload involves Rundll32.exe.
DeviceProcessEvents
| where FileName =~ "schtasks.exe"
// Check for the creation flag
| where ProcessCommandLine has_any ("/create", "-create")
// Check for the malicious payload trigger
| where ProcessCommandLine has "rundll32"
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, SHA256Detection Opportunity (KQL) 2
//CastleLoader and CastleRAT - Commandline Detections
// TAG150
// New Botnet Emerges from the Shadows: NightshadeC2 | eSentire
DeviceProcessEvents
| where InitiatingProcessCommandLine has_all ("-Force","Add-MpPreference","-ExclusionProcess","C:","Users")
Bridewell CSIRT Detection Rules & Analytics
The following detection content was generated through our managed threat intelligence, threat hunting, and detection and response (MDR) services. The content automatically protects our customers from known and emerging threats.
| Detection Rule Name | Category |
|---|---|
| HTTP-CastleRAT-Unknown-Pivot-000003 | Infrastructure Hunting |
| HTTP-CastleRAT-000002 | Infrastructure Hunting |
| HASH-CastleRAT-000001 | Infrastructure Hunting |
| HTTP-CastleRAT-0000033 | Infrastructure Hunting |
| HTTP-CastleLoader-000001 | Infrastructure Hunting |
| KQL_MDE_DeviceProcessEvents_CastleLoader_DefenderExclusion | TTP Analytic |
| KQL_MDE_DeviceNetworkEvents_CastleRAT_C2Beaconing | TTP Analytic |
| KQL_MDE_DeviceProcessEvents_ClickFix_RunDialogPowerShell | TTP Analytic |
| KQL_MDE_DeviceProcessEvents_ClickFix_ClipboardExecution | TTP Analytic |
| KQL_MDE_DeviceProcessEvents_CastleLoader_UACBypass_WindirEnv | TTP Analytic |
| KQL_MDE_DeviceProcessEvents_CastleLoader_Rundll32_Ordinal61 | TTP Analytic |
| KQL_MDE_DeviceEvents_CastleLoader_CleanupAndPayloadDrop | TTP Analytic |
| KQL_MDE_DeviceProcessEvents_CastleLoader_RegistryCleanup_Windir | TTP Analytic |
| KQL_MDE_DeviceFileEvents_CastleLoader_PowerShellPayloadDrop | TTP Analytic |
| KQL_MDE_DeviceProcessEvents_CertUtil_URLCache_Download | TTP Analytic |
| KQL_SEN_SecurityEvent_ScheduledTask_Rundll32_Trigger | TTP Analytic |
| KQL_MDE_DeviceEvents_ScheduledTask_Rundll32_Registration_Parsed | TTP Analytic |
| KQL_MDE_DeviceFileEvents_ExecutablesInSuspiciousPaths | TTP Analytic |
