DAEMON Tools Environment Checker Executes from Windows Temp
This rule detects the execution of 'envchk.exe' from common Windows temporary directories (e.g., C:\Windows\Temp\ or C:\Users\<User>\AppData\Local\Temp\). It then correlates this activity with subsequent executions of system profiling commands such as 'hostname.exe', 'ipconfig.exe', 'tasklist.exe', 'wmic.exe', 'powershell.exe', or 'reg.exe' within a 5-minute window. The detection specifically looks for command-line arguments indicative of system information gathering (e.g., 'getmac', 'Win32_Product', 'Get-Package', 'Get-Culture', 'Get-DnsClient', 'tasklist', 'hostname'). This sequence of events is characteristic of the environment-check stage of the DAEMON Tools backdoor campaign, aiming to identify the system's configuration and environment.
Microsoft Sentinel (KQL)
