Tool
RSAT
- First Reported
- Apr 9, 2026
- Latest Reported
- Apr 9, 2026
Reported Context (1)
- You could detect it with traffic to 9389 (ADWS) but there's an even bigger problem there, all of RSAT uses ADWS. So sysadmins doing normal operations would trigger false positives. Correlating Windows Events 5156 and 1644 to Attribute ADWS Queries
People (9)
MITRE ATT&CK (2)
Products (5)
Tools (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.