DcRAT SendInfo Beacon Exfiltrating System Info and AV Products via svchost

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects anomalous network traffic from svchost.exe processes exhibiting suspicious behavior indicative of DcRAT, specifically reconnaissance activities that involve gathering system information and security product details for exfiltration to a Command and Control (C2) server.