DcRAT System and Security Software Enumeration via WMI and svchost Injection
Detects instances where svchost.exe (typically a system service host) is acting as the parent process to spawn reconnaissance utilities such as systeminfo.exe, wmic.exe, ipconfig.exe, or whoami.exe. This behavior is highly irregular as these utilities are typically invoked by users or administrative scripts, not system-level service processes, and may indicate process injection or malicious activity leveraging legitimate system processes.
Cortex XDR
