huntrule

Windows Process Execution: dctask64.exe by ManageEngine Endpoint Central

Alerts on Windows execution of ManageEngine Endpoint Central dctask64.exe with specific hash and suspicious command-line indicators.

FreeUnreviewedSigmahighv1
title: "Windows Process Execution: dctask64.exe by ManageEngine Endpoint Central"
id: e482cab3-ed59-4e75-bf54-d70ef0ce9479
status: test
description: This rule flags process creation events where dctask64.exe is executed, including matching specific image hash impes and command-line indicators. Because dctask64.exe is a signed ManageEngine Endpoint Central component, attackers may abuse it to perform actions such as DLL injection, arbitrary command/process execution, or stealthy execution. The detection relies on Windows process creation telemetry and matching the executable filename, specific file hash impes, and suspicious command-line substrings.
references:
  - https://twitter.com/gN3mes1s/status/1222088214581825540
  - https://twitter.com/gN3mes1s/status/1222095963789111296
  - https://twitter.com/gN3mes1s/status/1222095371175911424
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dctask64_arbitrary_command_and_dll_execution.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2020-01-28
modified: 2025-01-22
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \dctask64.exe
    - Hashes|contains:
        - IMPHASH=6834B1B94E49701D77CCB3C0895E1AFD
        - IMPHASH=1BB6F93B129F398C7C4A76BB97450BBA
        - IMPHASH=FAA2AC19875FADE461C8D89DCF2710A3
        - IMPHASH=F1039CED4B91572AB7847D26032E6BBF
  selection_cli:
    CommandLine|contains:
      - " executecmd64 "
      - " invokeexe "
      - " injectDll "
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 6345b048-8441-43a7-9bed-541133633d7a
    type: derived

What it detects

This rule flags process creation events where dctask64.exe is executed, including matching specific image hash impes and command-line indicators. Because dctask64.exe is a signed ManageEngine Endpoint Central component, attackers may abuse it to perform actions such as DLL injection, arbitrary command/process execution, or stealthy execution. The detection relies on Windows process creation telemetry and matching the executable filename, specific file hash impes, and suspicious command-line substrings.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.