Detect Rising Sun by searching for the behaviours linked to that malware family in threat intelligence, then confirming with endpoint and network evidence. Focus on suspicious process execution, persistence mechanisms, and unexpected outbound connections from affected systems. Correlate those signals with recent file changes and account activity before isolating the host and beginning eradication.
What to look for when you suspect Rising Sun
Detection starts with pattern recognition, not with a single signature. rising sun should be investigated as a malware family when endpoint telemetry shows unusual process trees, suspicious persistence, and activity that does not match the host’s normal role. Network logs matter as much as host logs because the family’s footprint often includes outbound connections that appear at the wrong time, to the wrong destinations, or at an unexpected cadence.
For an initial triage, treat the host as suspicious if file creation, scheduled tasks, services, registry changes, or startup entries appeared around the same time as new process execution. Correlate that with recent account activity, especially logons, privilege changes, and remote access events, so you can separate routine administration from likely compromise. MITRE ATT&CK Enterprise Matrix is useful here because it helps map those behaviours to common adversary techniques.
A practical hunt is strongest when it combines behaviour and context. Search for the same process name or hash across endpoints, but also look for matching parent-child execution chains, repeated persistence artefacts, and any network beacons that cluster around the same time window. If you have multiple sensors, correlate EDR, DNS, proxy, firewall, and authentication data so you can confirm the behaviour is persistent and not a one-off administrative action.
How to confirm an alert is really Rising Sun
Confirmation requires more than “it looks bad.” The key question is whether the behaviours line up with a coherent intrusion pattern on one host or several hosts. Start by validating the first execution point, then compare subsequent persistence and network activity against known-good baselines for that environment. If the same host also shows new or unusual file modifications and account use, the confidence level rises quickly.
Threat intelligence should be used as a filter, not as the final proof. Use it to narrow the hunt to the behaviours associated with the family, then verify locally with artefacts from the affected system. Check whether the suspicious process launched from a user-writable location, whether it spawned child processes that do not belong in that workflow, and whether its outbound traffic is consistent with command-and-control or staging behaviour rather than normal business traffic.
When the evidence is mixed, privilege and scope matter. A benign-looking process on a workstation becomes much more important if it is associated with a privileged account, a server role, or a system that should not be making direct external connections. SANS Security Resources is a good reference point for incident-handling and detection-workflow discipline, while FIRST supports the broader incident-response coordination side of the process.
Containment, eradication, and evidence preservation
Once Rising Sun is suspected, containment should be fast but not blind. Isolate the host before broad cleanup, because a malware family that has established persistence can reappear after a reboot or reconnect. Preserve the process list, network connections, autostart locations, and recent file and authentication records before you make changes, since those artefacts often answer how the intrusion began and whether it spread.
Eradication should follow the evidence, not the alert name. Remove persistence mechanisms, stop malicious processes, and confirm that the outbound communication pattern ceases after containment. Then review adjacent systems for the same indicators, because a single infected endpoint may be the visible part of a wider foothold. If you find the same account activity or file change pattern on other systems, expand the investigation before restoring normal access.
Recovery is safest when teams validate the rebuilt system against the original behavioural clues. If the host returns to service, continue watching for repeat persistence creation, repeated logon anomalies, or the same egress pattern that first exposed the malware. That is the point at which eradication either holds or fails.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1003 — Credential Dumping | Rising Sun hunts benefit from mapping host artefacts to adversary technique patterns. |
| Recommendation — Map observed behaviours to ATT&CK techniques and hunt for matching execution, persistence, and egress patterns. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Detection here depends on correlating endpoint, network, and account activity across logs. |
| Recommendation — Centralize and review logs so endpoint, network, and identity events can be correlated during malware hunting. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and network services are monitored to find potentially adverse events | The answer relies on monitoring network connections and correlating them with endpoint evidence. |
| RS.MA-01 — Incidents are contained | The response emphasizes isolating the host before eradication to stop spread and preserve evidence. | |
| Recommendation — Monitor outbound traffic for anomalies and tie it to host telemetry during incident detection. Contain suspected infected hosts quickly before beginning eradication and recovery. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Confirming Rising Sun requires analysis of logs, file changes, and account activity. |
| Recommendation — Review and correlate audit records to validate suspicious execution and access patterns. | ||
Practitioner Guidance
What to prioritise: Put endpoint execution, persistence, and outbound network correlation ahead of isolated indicators such as a single hash or filename. Behavioural clustering is what turns a possible malware hit into a credible Rising Sun case.
What to verify: Confirm whether the suspicious activity occurred on a system that should have no reason to initiate external connections or create new startup artefacts. That context is often the difference between a false positive and a real intrusion.
Escalation / exception: Escalate immediately if the host shows both persistence and recent account activity tied to privileged access, because that combination raises the chance of lateral movement or broader compromise.
Practitioner takeaway: The best detection is a small set of connected signals, not a long list of weak ones, so build your hunt around behaviour, timing, and scope before you decide to eradicate.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org