DcRAT GetTickCount64 Sandbox/VM Detection via Timing Loop (Operation DragonReturn)

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

This rule monitors for processes with suspicious file names (specifically identified as potential obfuscated binaries) that perform API calls to 'GetTickCount64' associated with sandbox evasion techniques such as environment detection, debugger checking, and memory inspection.