Windows Process Creation Indicator for Dtrack RAT Recon Commands

title: Windows Process Creation Indicator for Dtrack RAT Recon Commands
id: c84262eb-4c3c-47b1-95d2-aacdb048a5d1
status: stable
description: This rule flags Windows process creation that matches a set of command-line patterns associated with Dtrack RAT reconnaissance. The behavior matters because attackers commonly run system discovery commands to collect host/network information before further action. It relies on telemetry from process creation logs, specifically command-line content patterns for ping, ipconfig, and netsh usage with characteristic resource file paths.
references:
  - https://securelist.com/my-name-is-dtrack/93338/
  - https://securelist.com/andariel-deploys-dtrack-and-maui-ransomware/107063/
  - https://www.cyberbit.com/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/
  - https://app.any.run/tasks/4bc9860d-ab51-4077-9e09-59ad346b92fd/
  - https://app.any.run/tasks/ce4deab5-3263-494f-93e3-afb2b9d79f14/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/Dtrack-RAT/proc_creation_win_malware_dtrack.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-10-30
modified: 2025-11-03
tags:
  - attack.impact
  - attack.t1490
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_ping:
    CommandLine|re: ping\s+-n.{6,64}echo EEEE\s?>\s?
  selection_ipconfig:
    CommandLine|re: ipconfig\s+/all
    CommandLine|contains: \temp\res.ip
  selection_netsh:
    CommandLine|contains|all:
      - interface ip show config
      - \temp\netsh.res
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: f1531fa4-5b84-4342-8f68-9cf3fdbd83d4
    type: derived