JanelaRAT (BX RAT Variant): Detection and Defense for Latin American Financial Institutions

---
title: Potential Keylogger via Process Access (Winlogon/Explorer)
id: 8a4b1c92-9e4b-4d67-bc12-3e5a8f901235
status: experimental
description: Detects potential keylogging behavior consistent with JanelaRAT/BX RAT. A process accessing Winlogon or Explorer with specific access rights (VM_READ) often indicates input hook injection.
references:
  - https://attack.mitre.org/techniques/T1056/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1056.001
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith:
      - '\winlogon.exe'
      - '\explorer.exe'
    GrantedAccess|contains:
      - '0x1410'
      - '0x1010'
      - '0x143A'
    SourceImage|contains:
      - '\AppData\'
      - '\Temp\'
  condition: selection
falsepositives:
  - Legitimate security software scanning memory
  - Unknown
level: high
---
title: Suspicious Screen Capture via PowerShell
id: 9b5c2d03-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects PowerShell scripts attempting to load Windows API libraries for screen capturing (user32.dll), a technique used by JanelaRAT for surveillance.
references:
  - https://attack.mitre.org/techniques/T1113/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1113
logsource:
  category: script_block_log
  product: windows
detection:
  selection:
    ScriptBlockText|contains:
      - 'Add-Type -MemberDefinition'
      - 'user32.dll'
      - 'GetWindowDC'
      - 'BitBlt'
  condition: selection
falsepositives:
  - Legitimate administrative scripts
level: medium
---
title: Persistence via Unsigned Binary in Startup Folder
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects unsigned executables placed in the Startup folder, a common persistence mechanism for BX RAT variants like JanelaRAT.
references:
  - https://attack.mitre.org/techniques/T1547/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1547.001
logsource:
  category: file_create
  product: windows
detection:
  selection:
    TargetFilename|contains: '\Microsoft\Windows\Start Menu\Programs\Startup'
    TargetFilename|endswith: '.exe'
  filter:
    Signed: 'true'
  condition: selection and not filter
falsepositives:
  - Authorized IT software deployment
level: high

// Hunt for suspicious processes from User directories making network connections
let UserDirs = dynamic(["C:\\Users\\", "C:\\ProgramData\\"]);
DeviceProcessEvents
| whereFolderPath in~ UserDirs
| where InitiatingProcessFolderPath in~ UserDirs
| join kind=inner DeviceNetworkEvents on DeviceId, InitiatingProcessId
| where RemotePort in (443, 80, 8080) // Common C2 ports, adjust as needed
| where isnotempty(RemoteUrl)
| summarize StartTime = min(Timestamp), EndTime = max(Timestamp), ConnectionCount = count() by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteUrl
| order by ConnectionCount desc

-- Hunt for unsigned executables in user AppData directories
SELECT FullPath, Name, Size, Mtime, Username, Sig_Status, Sig_Subject
FROM glob(globs='C:\\Users\\*\\AppData\\*\\*.exe')
LEFT JOIN SELECT
  FullPath as SignedPath,
  Status as Sig_Status,
  Subject as Sig_Subject
FROM authenticode(filename=FullPath)
ON SignedPath = FullPath
WHERE Sig_Status != 'Valid'

# Remediation Script: Hunt for JanelaRAT/BX RAT Persistence Mechanisms

# Check Registry Run Keys for suspicious binaries in AppData
$Paths = @(
    "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
    "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
    "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
    "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce"
)

Write-Host "[+] Checking Registry Persistence Keys..."

foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        Get-ItemProperty -Path $Path -ErrorAction SilentlyContinue | Get-Member | Where-Object {$_.MemberType -eq "NoteProperty"} | ForEach-Object {
            $PropertyName = $_.Name
            $PropertyValue = (Get-ItemProperty -Path $Path).$PropertyName
            if ($PropertyValue -match "AppData" -or $PropertyValue -match "Temp") {
                Write-Host "[!] Suspicious Persistence Found: $Path\\$PropertyName -> $PropertyValue" -ForegroundColor Yellow
                # Uncomment to remove automatically (Use with caution)
                # Remove-ItemProperty -Path $Path -Name $PropertyName -Force
            }
        }
    }
}

# Check Startup Folders
Write-Host "[+] Checking Startup Folders..."
$StartupPath = [Environment]::GetFolderPath("Startup")
if (Test-Path $StartupPath) {
    Get-ChildItem -Path $StartupPath -Filter *.exe | ForEach-Object {
        # Check signature
        $sig = Get-AuthenticodeSignature $_.FullName
        if ($sig.Status -ne "Valid") {
            Write-Host "[!] Unsigned executable found in Startup: $($_.FullName)" -ForegroundColor Red
        }
    }
}
Write-Host "[+] Scan Complete."