Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
RAT

PlugX

RAT Needs review 52 detections found
This entry hasn't been reviewed yet. It was auto-detected from the MITRE ATT&CK catalog because it self-identifies as rat-type malware, but no one has curated a full summary or double-checked its reference links. Treat the details below as a starting point, not a verified profile.

Also known as: DestroyRAT, Kaba, Korplug, PlugX, Sogu, TVT, Thoper

Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0013) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's currently known; a proper summary and authoritative eradication references are pending.

Detection & eradication references

Curated links to authoritative sources — MITRE ATT&CK, CISA advisories, law-enforcement takedown announcements, and vendor threat-intel writeups — for removal, remediation, and further technical detail. Sigma Watch does not publish its own removal steps here, since malware behavior and tooling change too fast for a static write-up to stay reliably accurate.

Detection rules

Source Rule Status Updated
splunk Windows Masquerading Msdtc Process production 2026-05-13
splunk Windows Debugger Tool Execution production 2026-05-13
suricata ET MALWARE PlugX/Korplug CnC Activity rev 3 2024-04-30
suricata ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded WebUI Login Attempt M2 rev 2 2024-04-26
suricata ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Stack Overflow in Base64 Authorization Mechanism M1 rev 2 2024-04-26
suricata ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded WebUI Login Attempt M1 rev 2 2024-04-26
snort ET TROJAN PlugX CnC Beacon rev 2 2024-04-22
suricata ET MALWARE PlugX CnC Beacon rev 5 2024-04-21
suricata ET MALWARE PlugX Checkin rev 11 2024-04-14
suricata ET MALWARE PlugX/Destory HTTP traffic rev 6 2024-04-14
suricata ET MALWARE Win32/PlugX Related Domain in DNS Lookup rev 2 2024-03-26
suricata ET MALWARE Win32/Korplug.HQ CnC Activity rev 2 2024-03-26
suricata ET MALWARE PlugX DNS Lookup rev 2 2024-03-25
suricata ET EXPLOIT Shenzhen TVT DVR/NVR/IPC ConfigSyncProc RCE Attempt rev 2 2024-03-14
suricata ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded Credential ConfigSyncProc Login Attempt rev 2 2024-03-14
suricata ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded Credential ConfigSyncProc System Details Request rev 2 2024-03-14
suricata ET MALWARE Win32/PlugX Variant CnC Activity rev 2 2023-08-23
snort ET TROJAN Win32/PlugX Variant CnC Activity rev 2 2023-08-23
sigma Potential PlugX Activity test 2023-02-03
snort ET TROJAN Win32/Korplug.HQ CnC Activity rev 1 2022-08-11
snort ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded WebUI Login Attempt M2 rev 2 2022-04-20
suricata ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Stack Overflow in Base64 Authorization Mechanism M2 rev 1 2022-04-19
snort ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Stack Overflow in Base64 Authorization Mechanism M1 rev 2 2022-04-19
snort ET EXPLOIT Shenzhen TVT DVR/NVR/IPC ConfigSyncProc RCE Attempt rev 1 2022-04-19
snort ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded Credential ConfigSyncProc System Details Request rev 2 2022-04-19
snort ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded WebUI Login Attempt M1 rev 2 2022-04-19
snort ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded Credential ConfigSyncProc Login Attempt rev 2 2022-04-19
snort ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Stack Overflow in Base64 Authorization Mechanism M2 rev 2 2022-04-19
snort ET TROJAN Win32/PlugX Related Domain in DNS Lookup rev 2 2022-03-03
snort ET TROJAN PlugX/Korplug CnC Activity rev 2 2021-03-12
snort ET TROJAN PlugX DNS Lookup rev 2 2021-01-12
suricata ET MALWARE PlugX UDP CnC Beacon rev 1 2019-07-26
snort ET TROJAN PlugX UDP CnC Beacon rev 1 2015-09-17
snort ET TROJAN PlugX/Destory HTTP traffic rev 1 2014-06-06
snort ET TROJAN PlugX Checkin rev 5 2014-04-16
yara Codoso_PlugX_2 — —
yara Codoso_PGV_PVID_4 — —
yara Codoso_PlugX_1 — —
yara Codoso_PlugX_3 — —
yara IronTiger_PlugX_FastProxy — —
yara IronTiger_PlugX_Server — —
yara rtf_Kaba_jDoe — —
yara PlugX_NvSmartMax_Gen — —
yara Korplug_FAST — —
yara PlugX — —
yara Korplug — —
yara PlugXStrings — —
yara plugX — —
yara PlugX_mw — —
yara PLUGX_RedLeaves — —
yara Dropper_DeploysMalwareViaSideLoading — —
yara IronTiger_PlugX_DosEmulator — —