Deep#Door RAT: Detecting Python-Based Persistence and Windows Defense Evasion

---
title: Deep#Door RAT - Python Execution via Batch File
id: 9c8f4a12-3b5d-4e8f-9a1b-2c3d4e5f6789
status: experimental
description: Detects the execution of Python scripts initiated by Batch files, a technique used by Deep#Door to hide payloads. Legitimate admin scripts may trigger this, but correlation is required.
references:
  - https://securityaffairs.com/191567/malware/new-deepdoor-rat-uses-stealth-and-persistence-to-target-windows.html
author: Security Arsenal
date: 2025/04/09
tags:
  - attack.execution
  - attack.t1059.003
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
    Image|endswith: '\python.exe'
    CommandLine|contains:
      - '.py'
      - '-c '
      - 'import '
  filter_legitimate_dev:
    ParentImage|contains: 
      - '\Visual Studio'
      - '\JetBrains'
      - '\PyCharm'
      - '\VSCode'
  condition: selection and not filter_legitimate_dev
falsepositives:
  - Legitimate developer environments running Python scripts from CLI
level: high
---
title: Deep#Door RAT - Windows Defense Process Termination
id: b1e2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to terminate Windows Defender or other critical security processes, a key behavior of Deep#Door upon establishment.
references:
  - https://securityaffairs.com/191567/malware/new-deepdoor-rat-uses-stealth-and-persistence-to-target-windows.html
author: Security Arsenal
date: 2025/04/09
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\taskkill.exe'
      - '\taskmgr.exe'
      - '\tskill.exe'
  selection_cli:
    CommandLine|contains:
      - 'MsMpEng.exe'
      - 'SenseCncProxy.exe'
      - 'WinDefend'
      - 'SecurityHealthService.exe'
  condition: all of selection_*
falsepositives:
  - Administrators manually terminating hung security processes (rare)
level: critical

// Hunt for Deep#Door execution chain and defense evasion
let SuspiciousPython = 
  DeviceProcessEvents
  | where FileName in~ ("python.exe", "python3.exe")
  | where InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
  | where ProcessCommandLine has_any (".py", "import", "-c")
  | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256;

let DefenseTampering = 
  DeviceProcessEvents
  | where FileName in~ ("taskkill.exe", "sc.exe")
  | where ProcessCommandLine has_any ("MsMpEng", "WinDefend", "SenseCncProxy", "/stop", "/delete")
  | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine;

union SuspiciousPython, DefenseTampering
| order by Timestamp desc

-- Hunt for Deep#Door RAT indicators
SELECT 
  Pid, 
  Ppid, 
  Name, 
  CommandLine, 
  Exe,
  Username,
  StartTime
FROM pslist()
WHERE Name =~ "python"
  AND Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ "cmd" OR Name =~ "powershell")

-- Optional: Check for suspicious batch files in startup locations
-- SELECT FullPath, Mtime, Size FROM glob(globs="C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.bat")

<#
.SYNOPSIS
    Deep#Door RAT Remediation and Hardening Script
.DESCRIPTION
    Checks for Python persistence in Run keys, restores Windows Defender services,
    and hunts for suspicious batch files.
#>

Write-Host "[*] Starting Deep#Door RAT Remediation Checklist..." -ForegroundColor Cyan

# 1. Check for Python in Registry Run Keys (Common Persistence)
Write-Host "[+] Checking Registry Run Keys for Python execution..." -ForegroundColor Yellow
$runKeys = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key | Where-Object { $_.PSObject.Properties.Value -match "python" } | ForEach-Object {
            Write-Host "[!] Suspicious Python persistence found in $key" -ForegroundColor Red
            Write-Host "    Value: $($_.PSObject.Properties | Where-Object { $_.Value -match 'python' }).Name"
        }
    }
}

# 2. Ensure Windows Defender Services are Running
Write-Host "[+] Verifying Windows Defender Services..." -ForegroundColor Yellow
$defenderServices = @("WinDefend", "WdNisSvc", "Sense", "SecurityHealthService")
foreach ($svc in $defenderServices) {
    $service = Get-Service -Name $svc -ErrorAction SilentlyContinue
    if ($service) {
        if ($service.Status -ne "Running") {
            Write-Host "[!] Service $svc is stopped. Attempting to start..." -ForegroundColor Red
            try {
                Start-Service -Name $svc -ErrorAction Stop
                Write-Host "[+] Successfully started $svc" -ForegroundColor Green
            } catch {
                Write-Host "[-] Failed to start $svc. Manual intervention required." -ForegroundColor Red
            }
        } else {
            Write-Host "[+] Service $svc is running." -ForegroundColor Green
        }
    }
}

# 3. Hunt for recently modified .bat files in user profiles
Write-Host "[+] Scanning for recently modified batch files in user directories..." -ForegroundColor Yellow
$cutOffDate = (Get-Date).AddDays(-7)
Get-ChildItem -Path C:\Users\ -Filter *.bat -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { $_.LastWriteTime -gt $cutOffDate } | 
    Select-Object FullName, LastWriteTime, Length

Write-Host "[*] Remediation script completed." -ForegroundColor Cyan