Windows Process Creation: Detect dctask64.exe with Endpoint Central Execution/Injection Flags

Alerts on Windows execution of ManageEngine Endpoint Central dctask64.exe with specific hash and suspicious command-line indicators.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2020-01-28
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1055.001Dynamic-link Library Injection
Defense Evasion
- T1055.001Dynamic-link Library Injection
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags execution of the signed ManageEngine Endpoint Central binary dctask64.exe when the command line contains strings indicative of command execution or DLL injection behavior. Attackers may abuse this component for stealthy process manipulation, including DLL injection and arbitrary command/process execution. The detection relies on Windows process creation telemetry, matching the image filename ending with dctask64.exe, specific IMPHASH values, and targeted substrings in the command line.

Reporting behind it

Related detections9 linkedT1055.001 — drag to rearrange

Suspicious Process Injection via mavinject INJECTRUNNING

In-Memory Process Injection via Mavinject INJECTRUNNING (via process_creation)

Suspicious Service Reconfiguration of SessionEnv or IKEEXT for DLL Injection by EAGERBEE

Windows Process Creation: Renamed Mavinject32/64.EXE Execution

Windows Process Injection via Mavinject Using INJECTRUNNING Flag

Windows Process Execution and DLL Injection via Tracker.exe

Windows TAIDOOR RAT DLL Load via rundll32 Command Line

Windows renamed dctask64.exe execution via known IMPHASH values

Windows CreateRemoteThread with LoadLibraryA likely DLL injection

Windows Process Creation: Detect dctask64.exe with Endpoint Central Execution/Injection Flags

Pivot detection · T1055.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-execution-dctask64-exe-by-manageengine-endpoint-central-6345b048

title: "Windows Process Creation: Detect dctask64.exe with Endpoint Central Execution/Injection Flags"
id: e482cab3-ed59-4e75-bf54-d70ef0ce9479
status: test
description: This rule flags execution of the signed ManageEngine Endpoint Central binary dctask64.exe when the command line contains strings indicative of command execution or DLL injection behavior. Attackers may abuse this component for stealthy process manipulation, including DLL injection and arbitrary command/process execution. The detection relies on Windows process creation telemetry, matching the image filename ending with dctask64.exe, specific IMPHASH values, and targeted substrings in the command line.
references:
  - https://twitter.com/gN3mes1s/status/1222088214581825540
  - https://twitter.com/gN3mes1s/status/1222095963789111296
  - https://twitter.com/gN3mes1s/status/1222095371175911424
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dctask64_arbitrary_command_and_dll_execution.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2020-01-28
modified: 2025-01-22
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \dctask64.exe
    - Hashes|contains:
        - IMPHASH=6834B1B94E49701D77CCB3C0895E1AFD
        - IMPHASH=1BB6F93B129F398C7C4A76BB97450BBA
        - IMPHASH=FAA2AC19875FADE461C8D89DCF2710A3
        - IMPHASH=F1039CED4B91572AB7847D26032E6BBF
  selection_cli:
    CommandLine|contains:
      - " executecmd64 "
      - " invokeexe "
      - " injectDll "
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 6345b048-8441-43a7-9bed-541133633d7a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL