DcRAT/XenoRAT Injected svchost.exe Spawning System Reconnaissance Commands

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects instances of svchost.exe spawning common reconnaissance utilities like systeminfo, hostname, ipconfig, or wmic. This behavior is indicative of post-exploitation activity, specifically seen in DcRAT or XenoRAT malware where the process is injected and used for host environment profiling. The rule includes filters to exclude legitimate service-related svchost executions.