# SIGS: CastleLoader/RAT

**URL:** <https://community.emergingthreats.net/t/sigs-castleloader-rat/3130>\
**Category:** Rule Signatures\
**Created:** [December 9, 2025, 9:50am UTC](https://community.emergingthreats.net/t/sigs-castleloader-rat/3130 "2025-12-09T09:50:44Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![kevross33](https://avatars.discourse-cdn.com/v4/letter/k/82dd89/32.png) [@kevross33](https://community.emergingthreats.net/u/kevross33)\
**Post date:** [December 9, 2025, 9:50am UTC](https://community.emergingthreats.net/t/sigs-castleloader-rat/3130/1 "2025-12-09T09:50:44Z")

</div>

Hi,

At the end of this recordedfuture report is snort rules for CastleLoader and CastleRAT

> **[cta-2025-1209.pdf](https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-1209.pdf)**
>
> 9.31 MB

---

<div class="post-metadata">

**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\
**Post date:** [December 11, 2025, 4:07pm UTC](https://community.emergingthreats.net/t/sigs-castleloader-rat/3130/2 "2025-12-11T16:07:35Z")

</div>

Thanks @kevross33 , @kraghu has been combing through this report for signature food!

---

<div class="post-metadata">

**Author:** ![kraghu](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/kraghu/32/1307_2.png) [@kraghu](https://community.emergingthreats.net/u/kraghu)\
**Post date:** [December 12, 2025, 9:59pm UTC](https://community.emergingthreats.net/t/sigs-castleloader-rat/3130/3 "2025-12-12T21:59:07Z")

</div>

@kevross33  
2066299 - ET MALWARE CastleLoader Malware Outbound Checkin (malware.rules)  
Has been released, more to come soon!

---

<div class="post-metadata">

**Author:** ![kevross33](https://avatars.discourse-cdn.com/v4/letter/k/82dd89/32.png) [@kevross33](https://community.emergingthreats.net/u/kevross33)\
**Post date:** [December 15, 2025, 11:12am UTC](https://community.emergingthreats.net/t/sigs-castleloader-rat/3130/4 "2025-12-15T11:12:16Z")

</div>

There are signatures at the end in the appendix.

---

<div class="post-metadata">

**Author:** ![kraghu](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/kraghu/32/1307_2.png) [@kraghu](https://community.emergingthreats.net/u/kraghu)\
**Post date:** [December 17, 2025, 11:58pm UTC](https://community.emergingthreats.net/t/sigs-castleloader-rat/3130/6 "2025-12-17T23:58:19Z")

</div>

- 2066349 - ET MALWARE CastleLoader Malware Outbound Payload Request (malware.rules)

- 2066354 - ET MALWARE CastleLoader Malware Stager Outbound Payload Request (malware.rules)

- 2066355 - ET MALWARE CastleLoader Malware Inbound Command Retrieval via Finger Service (malware.rules)

- 2066356 - ET MALWARE CastleRAT Malware Outbound Handshake (malware.rules)

---

<div class="post-metadata">

**Author:** ![kraghu](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/kraghu/32/1307_2.png) [@kraghu](https://community.emergingthreats.net/u/kraghu)\
**Post date:** [December 19, 2025, 12:19am UTC](https://community.emergingthreats.net/t/sigs-castleloader-rat/3130/7 "2025-12-19T00:19:59Z")

</div>

- 2066363 - ET MALWARE CastleRAT Malware Outbound Handshake M2 (malware.rules)

- 2066364 - ET MALWARE CastleRAT Malware Outbound Handshake M3 (malware.rules)

- 2066366 - ET MALWARE CastleRAT Malware Outbound Handshake M4 (malware.rules)

- 2066367 - ET MALWARE CastleRAT Malware Outbound Handshake M5 (malware.rules)

- 2066368 - ET MALWARE CastleRAT Malware Outbound Handshake M6 (malware.rules)

- 2066369 - ET MALWARE CastleRAT Malware Outbound Handshake M7 (malware.rules)

- 2066370 - ET MALWARE CastleRAT Malware Outbound Handshake M8 (malware.rules)

- 2066371 - ET MALWARE CastleRAT Malware Outbound Handshake M9 (malware.rules)