DcRAT Sandbox Evasion: Doc-Opener Child with >30s Delay Before First Activity

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule monitors for processes that start after a delay (between 30 and 600 seconds) following the launch of common web browsers (Chrome, Edge) or PDF readers (Acrobat, Foxit). The rule excludes common background processes associated with these applications, focusing on potential delayed execution of malicious payloads or secondary stage activity after a user has opened a document or navigated a malicious site.