DcRAT Fileless CLR Load in svchost.exe via Cross-Process Injection (Operation DragonReturn)
Detects the injection of code into an svchost.exe process from a non-system directory, followed by the loading of .NET CLR runtime modules (clr.dll, clrjit.dll, or mscorlib.ni.dll) within 5 minutes. This pattern often indicates an attempt to execute managed code inside a legitimate system process, potentially to evade security controls. The rule further enriches the finding by identifying if the svchost.exe process is running in a non-standard service group, which serves as a high-confidence signal of anomalous behavior.
CQL
