Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Royal – Brute Ratel C4 Alongside NirSoft Credential-Recovery Suite

Royal Command and Control Sentinel
MITRE ATT&CK
Web Protocols
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (royal)
What This Detects
Royal affiliates run a distinctive NirSoft credential-recovery suite (MailPassView, IEPassView, Dialupass, NetPass) alongside the less-common Brute Ratel C4 framework for C2 – a combination rarely seen together outside Royal/BlackSuit intrusions.
Query
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName in~ ("mailpv.exe","iepv.exe","dialupass.exe","netpass.exe","rpv.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName
| union (
    DeviceProcessEvents
    | where Timestamp > ago(1d)
    | where ProcessCommandLine has_any ("Brute Ratel","badger","bruteratel")
)

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.