DcRAT fileless injection into svchost.exe via ZwWriteVirtualMemory and NtDuplicateObject
Detects suspicious API call sequences indicative of process injection into the 'svchost.exe' system process. The rule monitors for a combination of memory manipulation and thread execution APIs, such as 'ZwWriteVirtualMemory', 'NtDuplicateObject', 'VirtualAllocEx', and 'CreateRemoteThread', when initiated by processes other than legitimate Windows system processes. This is a common indicator of unauthorized code execution or lateral movement.
Splunk (SPL)
