DcRAT Operation DragonReturn - Staged File Cleanup in Windows Media Player Dir
This rule detects unauthorized file creation, deletion, or execution activity occurring within the 'Program Files\Windows Media Player\' directory by processes other than standard Windows Media Player executables. It flags activity such as creating non-media files (executables, scripts) or using system binaries like cmd, powershell, wmic, or fsutil to perform file operations in this directory. This behavior is indicative of potential masquerading or persistence techniques where an attacker places malicious payloads in a seemingly legitimate system location.
Splunk (SPL)
