Windows process creation: Suspicious Dtrack RAT ping and network recon commands
Alerts on Windows command-line reconnaissance patterns resembling Dtrack RAT activity.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2019-10-30
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule flags Windows process creation events whose command-line arguments match specific patterns consistent with Dtrack RAT-style host and network discovery. Attackers may use these recon commands to enumerate local network configuration and prepare subsequent malicious activity. The detection relies on process command-line telemetry, including regex matches for a scripted ping echo sequence and string matches for ipconfig/netsh commands referencing temporary artifact paths.
Reporting behind it
- securelist.comhttps://securelist.com/my-name-is-dtrack/93338/
- securelist.comhttps://securelist.com/andariel-deploys-dtrack-and-maui-ransomware/107063/
- cyberbit.comhttps://www.cyberbit.com/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/
- app.any.runhttps://app.any.run/tasks/4bc9860d-ab51-4077-9e09-59ad346b92fd/
- app.any.runhttps://app.any.run/tasks/ce4deab5-3263-494f-93e3-afb2b9d79f14/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/Dtrack-RAT/proc_creation_win_malware_dtrack.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows process creation: Suspicious Dtrack RAT ping and network recon commands"
id: c84262eb-4c3c-47b1-95d2-aacdb048a5d1
status: stable
description: This rule flags Windows process creation events whose command-line arguments match specific patterns consistent with Dtrack RAT-style host and network discovery. Attackers may use these recon commands to enumerate local network configuration and prepare subsequent malicious activity. The detection relies on process command-line telemetry, including regex matches for a scripted ping echo sequence and string matches for ipconfig/netsh commands referencing temporary artifact paths.
references:
- https://securelist.com/my-name-is-dtrack/93338/
- https://securelist.com/andariel-deploys-dtrack-and-maui-ransomware/107063/
- https://www.cyberbit.com/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/
- https://app.any.run/tasks/4bc9860d-ab51-4077-9e09-59ad346b92fd/
- https://app.any.run/tasks/ce4deab5-3263-494f-93e3-afb2b9d79f14/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/Dtrack-RAT/proc_creation_win_malware_dtrack.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-10-30
modified: 2025-11-03
tags:
- attack.impact
- attack.t1490
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_ping:
CommandLine|re: ping\s+-n.{6,64}echo EEEE\s?>\s?
selection_ipconfig:
CommandLine|re: ipconfig\s+/all
CommandLine|contains: \temp\res.ip
selection_netsh:
CommandLine|contains|all:
- interface ip show config
- \temp\netsh.res
condition: 1 of selection_*
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: f1531fa4-5b84-4342-8f68-9cf3fdbd83d4
type: derived