DcRAT System & Security Software Enumeration via svchost Spawning Recon Tools

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•0

Detects common reconnaissance or discovery commands (systeminfo, wmic, whoami, hostname, ipconfig, tasklist) when spawned by the Service Host process (svchost.exe). Legitimate system processes should typically not spawn these administrative tools directly; this behavior is frequently indicative of post-exploitation discovery activities.