DcRAT MixedSvc Process Injection into svchost.exe via Remote Thread

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

This rule monitors for suspicious process behaviors and module loads involving 'Mixed Reality.exe' and 'Windows Media Player' components. It detects instances where these files are launched by 'svchost.exe', load suspicious files like 'nvdaHelperRemote.dll', or are executed as a child of 'services.exe'. These behaviors are often associated with masquerading or potential process injection techniques.