DcRAT GetTickCount64 Sandbox Timing Check - Operation DragonReturn
Detects the execution of files with names commonly associated with malicious campaigns or masquerading, specifically 'COU_ITR-1_to_4_AY2026-27.exe' and 'Mixed Reality.exe'. This rule alerts on process start events involving these specific image names, capturing command-line details and process lineage for further analysis.
Cortex XDR
