BeepRAT Operation DragonClone — Recon Burst from Suspicious Parent + Schtask Chain

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects a post-compromise reconnaissance burst associated with BeepRAT, where a process running from a suspicious directory (AppData, Temp, or ProgramData) executes five or more system discovery commands within a 60-second window, following the creation of a scheduled task on the same host.