DcRAT Fileless .NET Injection into svchost.exe via Named Event ShitSetupOn26126k

Ibrahim Saud@tektrix

•updated Jun 27, 2026•1•0•1

Detects potential process injection attempts targeting svchost.exe by monitoring for specific memory manipulation and object handling APIs (ZwWriteVirtualMemory, NtDuplicateObject, ZwQueryAttributesFile). Also monitors for a synthetic process event containing a specific hardcoded command line string associated with potential malicious setup activity.