Potential Dtrack RAT Network Reconnaissance Activity
Detects potential Dtrack RAT activity by identifying specific command-line patterns associated with network discovery and system information gathering. The rule looks for the execution of 'ping' with specific arguments, 'ipconfig /all' redirecting output to a temporary file, and 'netsh interface ip show config' also redirecting output to a temporary file. These commands are commonly used by Dtrack for reconnaissance.
Sigma
