DcRAT Sandbox Evasion via GetTickCount64 Timing Loop - Long Pre-Network Latency

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•1•2

This rule detects processes launched from common user-writable or temporary directories (Downloads, AppData/Temp, etc.) that initiate a network connection more than 60 seconds after the process start time. This behavior is indicative of a delayed C2 beaconing or a dormant malicious payload being activated.