Renamed ZOHO Dctask64 Execution
This rule detects the execution of a renamed 'dctask64.exe' binary. 'dctask64.exe' is a legitimate, signed executable by ZOHO Corporation, part of ManageEngine Endpoint Central. Adversaries can abuse this binary for malicious purposes such as DLL injection, arbitrary command execution, and process execution. The detection logic specifically looks for process creation events where the image hash matches known hashes of 'dctask64.exe' but the filename is not 'dctask64.exe', indicating a potential masquerading attempt.
Sigma
