
title: ZOHO Dctask64 Process Injection
author: Florian Roth
date: 2020/01/28
description: Detects suspicious process injection using ZOHO's dctask64.exe
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    Image:
    - '*\dctask64.exe'
  SELECTION_3:
    CommandLine:
    - '*DesktopCentral_Agent\agent*'
  condition: (SELECTION_1 and SELECTION_2 and  not (SELECTION_3))
falsepositives:
- Unknown yet
fields:
- CommandLine
- ParentCommandLine
- ParentImage
id: 6345b048-8441-43a7-9bed-541133633d7a
level: high
logsource:
  category: process_creation
  product: windows
modified: 2020/08/30
references:
- https://twitter.com/gN3mes1s/status/1222088214581825540
- https://twitter.com/gN3mes1s/status/1222095963789111296
- https://twitter.com/gN3mes1s/status/1222095371175911424
status: experimental
tags:
- attack.defense_evasion
- attack.t1055.001
- attack.t1055
ruletype: SIGMA
