Profero | Rapid-IR WindowsAudit Backdoor: Inside a .NET RAT That Hides in Discord Profero IRT reverse engineered a .NET 8 RAT named WindowsAudit.exe recovered from a victim host in April 2026. It uses Discord as primary C2, runs as SYSTEM, tears down EDR in Safe Mode, and ships a full Active Directory attack toolkit.