DcRAT Initial Check-in: WMI AV Discovery Correlated with C2 Beacon to 223.26.63.40:2671

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects potential DcRAT initial beaconing by correlating WMI 'AntiVirusProduct' enumeration with subsequent outbound network connections to known DcRAT C2 infrastructure within a short time window. This behavior is indicative of a post-exploitation reconnaissance phase followed by initial callback.