DcRAT svchost.exe Process Injection via CreateToolhelp32Snapshot and Remote Thread
Detects DcRAT malware injecting malicious code into the legitimate Windows system process svchost.exe. The rule monitors for a suspicious process launching and accessing svchost.exe, coupled with the presence of specific API calls associated with process injection techniques like memory allocation, payload writing, and remote thread execution within the command line context.
YARA-L
