Cross-Campaign Email→Doc→Payload Chain (DragonReturn/Millenium/TONResolver)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

This rule correlates process execution patterns to detect a potential malicious document or file download chain. It monitors for child processes spawned by common document viewers (Adobe Acrobat, Word, Excel, PowerPoint) or browsers (Edge, Chrome, Firefox) that subsequently launch suspicious interpreters (cmd, powershell, wscript) or tools (7z, rar), finally leading to potentially malicious payload execution within common user-writable directories, or obfuscated PowerShell command-line execution.