DcRAT Steganography: Process Spawning Child with JPEG Path + Unsigned DLL Load + TLS C2
Detects a suspicious multi-stage infection sequence associated with DcRAT, characterized by a process spawning a child with references to image files (.jpg/.jpeg), followed by the loading of an unsigned DLL from the same directory, and culminating in a TLS network connection within a narrow time window.
Microsoft Sentinel (KQL)
