Sigma rule: Potential Dtrack RAT Activity

Rule

Title

Potential Dtrack RAT Activity

Status

stable

Level

critical

Author

Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Date

2019-10-30

Modified

2025-11-03

File

rules-emerging-threats/2019/Malware/Dtrack-RAT/proc_creation_win_malware_dtrack.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential Dtrack RAT activity via specific process patterns

Log source

product

windows

category

process_creation

Detection

selection_ping:
    CommandLine|re: 'ping\s+-n.{6,64}echo EEEE\s?>\s?'
selection_ipconfig:
    CommandLine|re: 'ipconfig\s+/all'
    CommandLine|contains: '\temp\res.ip'
selection_netsh:
    CommandLine|contains|all:
        - 'interface ip show config'
        - '\temp\netsh.res'
condition: 1 of selection_*

False positives (as the rule lists them)

• Unlikely

Tags

• attack.impact
• attack.t1490
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1490

References

• https://securelist.com/my-name-is-dtrack/93338/
• https://securelist.com/andariel-deploys-dtrack-and-maui-ransomware/107063/
• https://www.cyberbit.com/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/
• https://app.any.run/tasks/4bc9860d-ab51-4077-9e09-59ad346b92fd/
• https://app.any.run/tasks/ce4deab5-3263-494f-93e3-afb2b9d79f14/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2019/Malware/Dtrack-RAT/proc_creation_win_malware_dtrack.yml