Analytics Story: Interlock Rat

Date: 2025-07-28 ID: b2d83c79-b50e-4aff-a9f7-8ea315369de1 Author: Teoderick Contreras, Splunk Product: Splunk Enterprise Security

Description

This detection identifies behavioral indicators consistent with the Interlock RAT (Remote Access Trojan) malware family. Interlock RAT is a stealthy and modular backdoor primarily used for unauthorized remote control, data exfiltration, and system reconnaissance. The malware typically arrives via phishing campaigns or is dropped by other malware strains. Upon execution, it establishes persistence, connects to a command-and-control (C2) server, and allows attackers full access to the compromised system.

Why it matters

Interlock RAT is a relatively new entrant in the malware ecosystem, first observed in mid-to-late 2024. Interlock RAT distinguishes itself with a lightweight binary, encrypted communications, and a plugin-based architecture that allows attackers to load new capabilities post-compromise. Interlock employs a multi-stage attack chain, starting by compromising legitimate websites that deliver fake browser updates, such as Google Chrome or MS Edge installers. These fake installers execute a PowerShell backdoor facilitating the execution of multiple tools, and ultimately leading to the ransomware payload delivery.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
CHCP Command Execution	Command and Scripting Interpreter	Anomaly
CMD Carry Out String Command Parameter	Windows Command Shell	Hunting
Executables Or Script Creation In Suspicious Path	Masquerading	Anomaly
Executables Or Script Creation In Temp Path	Masquerading	Anomaly
Windows Anonymous Pipe Activity	Inter-Process Communication	Hunting
Windows Rundll32 Load DLL in Temp Dir	Rundll32	Anomaly
Windows Suspicious Process File Path	Create or Modify System Process, Match Legitimate Resource Name or Location	TTP

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
CrowdStrike ProcessRollup2	N/A	`crowdstrike:events:sensor`	`crowdstrike`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 17	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 18	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`

References

Source: GitHub | Version: 1