DcRAT Screen Capture via debug.txt Staging File (Operation DragonReturn)

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects the creation, modification, or deletion of the 'C:\debug.txt' file, which is an artifact associated with the DcRAT malware's screen capture module. The rule specifically monitors for this file's activity and highlights when the deletion is performed by 'svchost.exe', a common process used for masquerading malicious activity.