Ratty Bot [repack]

Use Sysmon (Event ID 19-21) to alert on WMI event consumer creations. Any new permanent WMI subscription should be treated as a red alert. Tools like WMITools from Microsoft can list active bindings: wmic /namespace:\\root\subscription PATH __EventFilter GET .

Since Ratty Bot abuses WebSockets to legitimate clouds, you cannot block AWS or Azure outright. Instead, implement SSL decryption (TLS Inspection) on your next-gen firewall. Look for unusual WebSocket frame lengths or traffic patterns that do not match the declared API structure (e.g., large binary blobs sent to an endpoint that usually only handles JSON). Ratty Bot