DcRAT Steganographic JPEG Payload Staging - Operation DragonReturn

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects potential DcRAT staging activity identified in Operation DragonReturn. The rule monitors for the creation of JPEG files in suspicious locations by non-browser processes (Sysmon EID 11), and the loading of .NET DLLs or files from staging directories by LOLBins such as mshta.exe, regsvr32.exe, or rundll32.exe (Sysmon EID 7).