cscli scenarios install sigmahq/proc_creation_win_dctask64_arbitrary_command_and_dll_execution1type: trigger2name: sigmahq/proc_creation_win_dctask64_arbitrary_command_and_dll_execution3description: |4 Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.Image endsWith '\\dctask64.exe' || evt.Parsed.Hashes contains '6834B1B94E49701D77CCB3C0895E1AFD' || evt.Parsed.Hashes contains '1BB6F93B129F398C7C4A76BB97450BBA' || evt.Parsed.Hashes contains 'FAA2AC19875FADE461C8D89DCF2710A3' || evt.Parsed.Hashes contains 'F1039CED4B91572AB7847D26032E6BBF') && (evt.Parsed.CommandLine contains ' executecmd64 ' || evt.Parsed.CommandLine contains ' invokeexe ' || evt.Parsed.CommandLine contains ' injectDll '))7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t1055.0011516 label: "ManageEngine Endpoint Central Dctask64.EXE Potential Abuse"17 behavior : "windows:audit"18 remediation: false1920scope:21 type: ParentProcessId22 expression: evt.Parsed.ParentProcessId2324