DcRAT Operation DragonReturn Named Event 'Global\ShitSetupOn26126k' Creation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects the creation of synchronization objects with names matching specific patterns often associated with malicious setups or obfuscated file naming conventions. It joins these object creation events with process rollup data to provide context on the originating process, including command line arguments and file paths.