Analytics Story: Castle RAT

Date: 2025-10-31 ID: 132ea5bd-b085-4a12-afb4-cac38a81e865 Author: Teoderick Contreras, Splunk Product: Splunk Enterprise Security

Description

Leverage searches that allow you to detect and investigate unusual activities that may be related to Castle RAT, a remote access trojan observed in targeted intrusion campaigns. Castle RAT provides adversaries with capabilities such as remote command execution, file exfiltration, keystroke logging, and screen capture, often delivered via phishing or malicious installers. Detectable indicators include anomalous process parentage (legitimate browsers or system utilities spawned by unknown executables), uncommon command-line switches, persistent autorun entries, and suspicious network connections to uncommon domains or dynamic DNS. Effective investigations correlate process creation events, command-line arguments, network telemetry, and file hashes with endpoint memory and disk forensics to confirm compromise and scope impact, while prioritizing containment and credential resets.

Why it matters

Castle RAT, a stealthy remote access trojan that operators employ to maintain long-term access to compromised hosts. In an affected environment, defenders might trace a breadcrumb trail of subtle anomalies like innocuous-looking installers that drop backdoor components, benign processes acting as parents for unexpected browser launches, and erratic outbound connections to ephemeral domains. Investigation narratives often follow credential misuse, lateral movement, and periods of staged data collection before exfiltration, with incident responders piecing together timelines from process creation logs, memory artifacts, and network telemetry. Prompt containment, credential resets, and forensic imaging are typical mitigation steps, while lessons learned feed improved detection rules and endpoint hardening to reduce

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Cisco NVM - Suspicious Network Connection to IP Lookup Service API	IP Addresses, System Network Configuration Discovery	Anomaly
Executables Or Script Creation In Suspicious Path	Masquerading	Anomaly
Schedule Task with Rundll32 Command Trigger	Scheduled Task/Job	TTP
Windows Anonymous Pipe Activity	Inter-Process Communication	Hunting
Windows Browser Process Launched with Unusual Flags	Browser Session Hijacking	Anomaly
Windows ComputerDefaults Spawning a Process	Bypass User Account Control	TTP
Windows Disable or Stop Browser Process	Disable or Modify Tools	TTP
Windows Handle Duplication in Known UAC-Bypass Binaries	Token Impersonation/Theft	Anomaly
Windows Scheduled Task with Highest Privileges	Scheduled Task	TTP
Windows Scheduled Task with Suspicious Name	Scheduled Task	TTP
Windows Schtasks Create Run As System	Scheduled Task	TTP
Windows Suspicious Process File Path	Create or Modify System Process, Match Legitimate Resource Name or Location	TTP
Windows UAC Bypass Suspicious Child Process	Bypass User Account Control	TTP
WinEvent Scheduled Task Created to Spawn Shell	Scheduled Task	TTP
WinEvent Scheduled Task Created Within Public Path	Scheduled Task	TTP
Windows Gather Victim Network Info Through Ip Check Web Services	IP Addresses	Anomaly

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Cisco Network Visibility Module Flow Data	Network	`cisco:nvm:flowdata`	`not_applicable`
CrowdStrike ProcessRollup2	N/A	`crowdstrike:events:sensor`	`crowdstrike`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 10	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 17	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 18	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 22	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4698	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4700	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4702	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`

References

https://www.recordedfuture.com/research/from-castleloader-to-castlerat-tag-150-advances-operations

Source: GitHub | Version: 1