RAT

MarkiRAT

RAT Needs review 12 detections found

This entry hasn't been reviewed yet. It was auto-detected from the MITRE ATT&CK catalog because it self-identifies as rat-type malware, but no one has curated a full summary or double-checked its reference links. Treat the details below as a starting point, not a verified profile.

Also known as: MarkiRAT

Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0652) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's currently known; a proper summary and authoritative eradication references are pending.

Detection & eradication references

Curated links to authoritative sources — MITRE ATT&CK, CISA advisories, law-enforcement takedown announcements, and vendor threat-intel writeups — for removal, remediation, and further technical detail. Sigma Watch does not publish its own removal steps here, since malware behavior and tooling change too fast for a static write-up to stay reliably accurate.

MarkiRAT, Software S0652 — MITRE ATT&CK

Detection rules

Source	Rule	Status	Updated
suricata	ET MALWARE MarkiRAT Data Exfiltration Attempt	rev 1	2026-07-02
snort	ET TROJAN MarkiRAT Data Exfiltration Attempt	rev 1	2026-07-02
snort	ET TROJAN MarkiRAT CnC Checkin Attempt	rev 1	2026-07-02
suricata	ET MALWARE MarkiRAT CnC Checkin Attempt	rev 1	2026-07-02
suricata	ET MALWARE W32/Echmark/MarkiRAT CnC Activity M3	rev 3	2024-04-30
suricata	ET MALWARE W32/Echmark/MarkiRAT CnC Response	rev 4	2024-04-14
suricata	ET MALWARE W32/Echmark/MarkiRAT CnC Request	rev 3	2024-04-12
suricata	ET MALWARE W32/Echmark/MarkiRAT CnC Host Checkin	rev 3	2024-04-12
snort	ET TROJAN W32/Echmark/MarkiRAT CnC Activity M3	rev 1	2021-07-26
snort	ET TROJAN W32/Echmark/MarkiRAT CnC Request	rev 2	2020-07-06
snort	ET TROJAN W32/Echmark/MarkiRAT CnC Response	rev 2	2020-07-06
snort	ET TROJAN W32/Echmark/MarkiRAT CnC Host Checkin	rev 2	2020-07-06