Windows Process Creation: Detect dctask64.exe with Endpoint Central Execution/Injection Flags
Alerts on Windows execution of ManageEngine Endpoint Central dctask64.exe with specific hash and suspicious command-line indicators.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2020-01-28
- Updated
- 2026-07-31
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags execution of the signed ManageEngine Endpoint Central binary dctask64.exe when the command line contains strings indicative of command execution or DLL injection behavior. Attackers may abuse this component for stealthy process manipulation, including DLL injection and arbitrary command/process execution. The detection relies on Windows process creation telemetry, matching the image filename ending with dctask64.exe, specific IMPHASH values, and targeted substrings in the command line.
Reporting behind it
- twitter.comhttps://twitter.com/gN3mes1s/status/1222088214581825540
- twitter.comhttps://twitter.com/gN3mes1s/status/1222095963789111296
- twitter.comhttps://twitter.com/gN3mes1s/status/1222095371175911424
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dctask64_arbitrary_command_and_dll_execution.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Detect dctask64.exe with Endpoint Central Execution/Injection Flags"
id: e482cab3-ed59-4e75-bf54-d70ef0ce9479
status: test
description: This rule flags execution of the signed ManageEngine Endpoint Central binary dctask64.exe when the command line contains strings indicative of command execution or DLL injection behavior. Attackers may abuse this component for stealthy process manipulation, including DLL injection and arbitrary command/process execution. The detection relies on Windows process creation telemetry, matching the image filename ending with dctask64.exe, specific IMPHASH values, and targeted substrings in the command line.
references:
- https://twitter.com/gN3mes1s/status/1222088214581825540
- https://twitter.com/gN3mes1s/status/1222095963789111296
- https://twitter.com/gN3mes1s/status/1222095371175911424
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dctask64_arbitrary_command_and_dll_execution.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2020-01-28
modified: 2025-01-22
tags:
- attack.privilege-escalation
- attack.stealth
- attack.t1055.001
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \dctask64.exe
- Hashes|contains:
- IMPHASH=6834B1B94E49701D77CCB3C0895E1AFD
- IMPHASH=1BB6F93B129F398C7C4A76BB97450BBA
- IMPHASH=FAA2AC19875FADE461C8D89DCF2710A3
- IMPHASH=F1039CED4B91572AB7847D26032E6BBF
selection_cli:
CommandLine|contains:
- " executecmd64 "
- " invokeexe "
- " injectDll "
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 6345b048-8441-43a7-9bed-541133633d7a
type: derived