RAT

NETWIRE

RAT Needs review 30 detections found

This entry hasn't been reviewed yet. It was auto-detected from the MITRE ATT&CK catalog because it self-identifies as rat-type malware, but no one has curated a full summary or double-checked its reference links. Treat the details below as a starting point, not a verified profile.

Also known as: NETWIRE

Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0198) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's currently known; a proper summary and authoritative eradication references are pending.

Detection & eradication references

Curated links to authoritative sources — MITRE ATT&CK, CISA advisories, law-enforcement takedown announcements, and vendor threat-intel writeups — for removal, remediation, and further technical detail. Sigma Watch does not publish its own removal steps here, since malware behavior and tooling change too fast for a static write-up to stay reliably accurate.

NETWIRE, Software S0198 — MITRE ATT&CK

Detection rules

Source	Rule	Status	Updated
sigma	Potential NetWire RAT Activity - Registry	test	2025-11-03
suricata	ET MALWARE CDT Credphish/Netwire Campaign DNS Lookup	rev 6	2024-04-13
suricata	ET MALWARE CDT Credphish/Netwire Campaign DNS Lookup	rev 6	2024-04-13
suricata	ET MALWARE CDT Credphish/Netwire Campaign DNS Lookup	rev 6	2024-04-13
suricata	ET MALWARE CDT Credphish/Netwire Campaign DNS Lookup	rev 6	2024-04-13
suricata	ET MALWARE CDT Credphish/Netwire Campaign DNS Lookup	rev 6	2024-04-13
suricata	ET MALWARE CDT Credphish/Netwire Campaign DNS Lookup	rev 6	2024-04-13
suricata	ET MALWARE CDT Credphish/Netwire Campaign DNS Lookup	rev 6	2024-04-13
suricata	ET MALWARE Netwire RAT Check-in 2	rev 3	2024-03-14
suricata	ET MALWARE Netwire RAT Check-in 2	rev 3	2024-03-14
suricata	ET MALWARE Netwire RAT Check-in	rev 7	2024-03-14
snort	ET TROJAN Netwire RAT Check-in 2	rev 2	2022-08-10
snort	ET TROJAN Netwire RAT Check-in 2	rev 2	2022-08-10
snort	ET TROJAN Netwire RAT Check-in	rev 6	2022-08-09
snort	ET TROJAN CDT Credphish/Netwire Campaign DNS Lookup	rev 2	2019-08-28
snort	ET TROJAN CDT Credphish/Netwire Campaign DNS Lookup	rev 2	2019-08-28
snort	ET TROJAN CDT Credphish/Netwire Campaign DNS Lookup	rev 2	2019-08-28
snort	ET TROJAN CDT Credphish/Netwire Campaign DNS Lookup	rev 2	2019-08-28
snort	ET TROJAN CDT Credphish/Netwire Campaign DNS Lookup	rev 2	2019-08-28
snort	ET TROJAN CDT Credphish/Netwire Campaign DNS Lookup	rev 2	2019-08-28
snort	ET TROJAN CDT Credphish/Netwire Campaign DNS Lookup	rev 2	2019-08-28
suricata	ET MALWARE NetWire / Ozone / Darktrack Alien RAT - Client KeepAlive	rev 6	2019-07-26
suricata	ET MALWARE NetWire Variant - Client Hello	rev 2	2019-07-26
suricata	ET MALWARE NetWire / Ozone / Darktrack Alien RAT - Server Hello	rev 6	2019-07-26
suricata	ET MALWARE NetWire Variant - Server Directory Listing Request	rev 2	2019-07-26
snort	ET TROJAN NetWire / Ozone / Darktrack Alien RAT - Server Hello	rev 6	2017-08-17
snort	ET TROJAN NetWire / Ozone / Darktrack Alien RAT - Client KeepAlive	rev 7	2016-08-30
snort	ET TROJAN NetWire Variant - Client Hello	rev 2	2015-10-22
snort	ET TROJAN NetWire Variant - Server Directory Listing Request	rev 2	2015-10-22
yara	netwire	—	—