DcRAT Fileless .NET Injection into svchost.exe via Operation DragonReturn
Detects multiple indicators of process injection into svchost.exe including suspicious process access rights, remote thread creation, unexpected loading of .NET CLR modules, and the subsequent spawning of suspicious child processes. The rule aggregates these signals to identify potential fileless execution or persistence mechanisms within a legitimate system process.
Splunk (SPL)
