{
  "title": "SystemHelpDesk Detection - Prorat (Rat) Execution & Triage",
  "id": "66591b2b-1931-5e0c-b97e-83ade4e8e399",
  "status": "production",
  "description": "Detects execution, defense evasion, and persistence behaviors associated with the Prorat malware family. Detects unauthorized persistence creation via Windows Registry Run keys, scheduled tasks, and privilege escalation indicative of RAT installations.",
  "references": [
    "https://malware-families-catalog.systemhelpdesk.com/families/prorat",
    "https://malware-families-catalog.systemhelpdesk.com/defensive/backdoor-rat-protection",
    "https://malware-families-catalog.systemhelpdesk.com/"
  ],
  "author": "Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP",
  "date": "2026-10-14",
  "modified": "2026-10-14",
  "tags": [
    "attack.rat",
    "author.ricky-jordan",
    "source.systemhelpdesk-mfc",
    "attack.t1059_003",
    "attack.t1056_001",
    "attack.t1113",
    "attack.t1125",
    "attack.t1543_003"
  ],
  "logsource": {
    "category": "process_creation",
    "product": "windows"
  },
  "detection": {
    "selection_process": {
      "Image|endswith": [
        "\\reg.exe",
        "\\schtasks.exe",
        "\\cmd.exe",
        "\\powershell.exe"
      ],
      "CommandLine|contains": [
        "\\CurrentVersion\\Run",
        "/create /tn",
        "bypass -enc",
        "net user /add",
        "net localgroup administrators"
      ]
    },
    "condition": "selection_process"
  },
  "falsepositives": [
    "Legitimate enterprise administrative scripts during approved change windows",
    "Authorized IT software deployment utilities and backup management agents"
  ],
  "level": "high"
}