Operation DragonReturn DcRAT Sandbox Evasion via GetTickCount64 Timing Check

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects sandbox evasion behavior linked to the Operation DragonReturn DcRAT loader. The malware uses the GetTickCount64 API in a tight loop with Sleep(1) calls to identify and detect sandbox environments that accelerate system time. The rule monitors for the suspicious execution of specific executables and subsequent process injection into svchost.exe.