Daemon Tools Lite Embedded Malicious Code (CVE-2026-8398)

let daemonToolsProcesses = DeviceProcessEvents
| where FileName in~ ("daemon.exe", "DTLite.exe", "DTAgent.exe", "DTShellHlp.exe")
| project DeviceId, DeviceName, Timestamp, ProcessId, FileName, FolderPath, SHA256, ProcessCommandLine, AccountName, InitiatingProcessFileName;
let suspiciousChildren = DeviceProcessEvents
| where InitiatingProcessFileName in~ ("daemon.exe", "DTLite.exe", "DTAgent.exe", "DTShellHlp.exe")
| where FileName !in~ ("daemon.exe", "DTLite.exe", "DTAgent.exe", "DTShellHlp.exe", "conhost.exe")
| project DeviceId, DeviceName, Timestamp, ProcessId, FileName, FolderPath, ProcessCommandLine, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine;
let networkFromDaemon = DeviceNetworkEvents
| where InitiatingProcessFileName in~ ("daemon.exe", "DTLite.exe", "DTAgent.exe", "DTShellHlp.exe")
| where RemoteIPType != "Loopback"
| project DeviceId, DeviceName, Timestamp, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine;
daemonToolsProcesses
| union suspiciousChildren
| union networkFromDaemon
| summarize EventCount=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceId, DeviceName, FileName, FolderPath, AccountName
| sort by EventCount desc

index=endpoint sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", "WinEventLog:Security", "crowdstrike:events:sensor")
| eval parent_lower=lower(ParentImage), image_lower=lower(Image)
| where parent_lower IN ("*\\daemon.exe", "*\\dtlite.exe", "*\\dtagent.exe", "*\\dtshellhlp.exe")
   OR image_lower IN ("*\\daemon.exe", "*\\dtlite.exe", "*\\dtagent.exe", "*\\dtshellhlp.exe")
| eval is_suspicious_child=if(parent_lower IN ("*\\daemon.exe", "*\\dtlite.exe", "*\\dtagent.exe", "*\\dtshellhlp.exe") AND NOT image_lower IN ("*\\conhost.exe", "*\\daemon.exe", "*\\dtlite.exe", "*\\dtagent.exe"), 1, 0)
| stats count AS event_count, earliest(_time) AS first_seen, latest(_time) AS last_seen, values(CommandLine) AS command_lines, values(Image) AS child_processes BY host, ParentImage, user
| where is_suspicious_child=1 OR event_count > 0
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - event_count

sequence by host.name with maxspan=5m
  [process where event.type == "start"
   and process.name : ("daemon.exe", "DTLite.exe", "DTAgent.exe", "DTShellHlp.exe")]
  [any where
    (event.category == "process" and process.parent.name : ("daemon.exe", "DTLite.exe", "DTAgent.exe", "DTShellHlp.exe")
     and not process.name : ("conhost.exe", "daemon.exe", "DTLite.exe", "DTAgent.exe", "DTShellHlp.exe"))
    or
    (event.category == "network" and process.name : ("daemon.exe", "DTLite.exe", "DTAgent.exe", "DTShellHlp.exe")
     and not destination.ip : ("127.0.0.1", "::1"))
  ]

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time, sourceip, destinationip, destinationport, username, "Application" AS application, "Process Name" AS process_name, "Parent Process Name" AS parent_process_name, "Command" AS command_line, QIDNAME(qid) AS event_name, logsourcename(logsourceid) AS log_source
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) IN ('Microsoft Windows Security Event Log', 'Sysmon')
AND (
  LOWER("Process Name") LIKE '%daemon.exe%'
  OR LOWER("Process Name") LIKE '%dtlite.exe%'
  OR LOWER("Process Name") LIKE '%dtagent.exe%'
  OR LOWER("Process Name") LIKE '%dtshellhlp.exe%'
  OR LOWER("Parent Process Name") LIKE '%daemon.exe%'
  OR LOWER("Parent Process Name") LIKE '%dtlite.exe%'
  OR LOWER("Parent Process Name") LIKE '%dtagent.exe%'
  OR LOWER("Parent Process Name") LIKE '%dtshellhlp.exe%'
)
AND NOT (
  LOWER("Process Name") LIKE '%conhost.exe%'
  OR destinationip IS NULL
)
ORDER BY starttime DESC
LAST 24 HOURS

_sourceCategory=endpoint/windows* OR _sourceCategory=sysmon*
| json auto
| where %"process.name" matches /(?i)(daemon\.exe|DTLite\.exe|DTAgent\.exe|DTShellHlp\.exe)/
   OR %"process.parent.name" matches /(?i)(daemon\.exe|DTLite\.exe|DTAgent\.exe|DTShellHlp\.exe)/
| where !(%"process.name" matches /(?i)(conhost\.exe)/)
| eval is_child_spawn = if(%"process.parent.name" matches /(?i)(daemon\.exe|DTLite\.exe|DTAgent\.exe|DTShellHlp\.exe)/, "yes", "no")
| stats count AS event_count, first(%"@timestamp") AS first_seen, last(%"@timestamp") AS last_seen, values(%"process.name") AS process_names, values(%"process.command_line") AS command_lines BY _sourceHost, %"user.name", is_child_spawn
| where event_count > 0
| sort by event_count desc

rule cve_2026_8398_daemon_tools_malicious_code {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects suspicious child process spawning or network activity from Daemon Tools Lite binaries indicating embedded malicious code (CVE-2026-8398)"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-8398"

  events:
    $e1.metadata.event_type = "PROCESS_LAUNCH"
    $e1.principal.process.file.full_path = /(?i)(daemon\.exe|DTLite\.exe|DTAgent\.exe|DTShellHlp\.exe)/
    $e1.target.process.file.full_path != /(?i)(conhost\.exe|daemon\.exe|DTLite\.exe|DTAgent\.exe|DTShellHlp\.exe)/
    $e1.principal.hostname = $hostname

    // OR network events from daemon tools binaries
    $e2.metadata.event_type = "NETWORK_CONNECTION"
    $e2.principal.process.file.full_path = /(?i)(daemon\.exe|DTLite\.exe|DTAgent\.exe|DTShellHlp\.exe)/
    not $e2.target.ip = "127.0.0.1"
    not $e2.target.ip = "::1"
    $e2.principal.hostname = $hostname

  match:
    $hostname over 5m

  condition:
    $e1 or $e2
}

#event_simpleName IN (ProcessRollup2, NetworkConnectIP4, NetworkConnectIP6)
| ImageFileName = /(?i)(daemon\.exe|DTLite\.exe|DTAgent\.exe|DTShellHlp\.exe)/
   OR ParentBaseFileName = /(?i)(daemon\.exe|DTLite\.exe|DTAgent\.exe|DTShellHlp\.exe)/
| ImageFileName != /(?i)(conhost\.exe)/
| eval ProcessContext = coalesce(CommandLine, "N/A"), NetworkTarget = coalesce(RemoteAddressIP4, RemoteAddressIP6, "N/A")
| eval IsSuspiciousChild = if(match(ParentBaseFileName, /(?i)(daemon\.exe|DTLite\.exe|DTAgent\.exe|DTShellHlp\.exe)/) AND not match(ImageFileName, /(?i)(daemon\.exe|DTLite\.exe|DTAgent\.exe|DTShellHlp\.exe)/), true, false)
| stats count() AS EventCount, earliest(timestamp) AS FirstSeen, latest(timestamp) AS LastSeen, values(ImageFileName) AS ChildProcesses, values(NetworkTarget) AS NetworkTargets BY aid, ComputerName, UserName, IsSuspiciousChild
| where IsSuspiciousChild = true OR NetworkTargets != "N/A"
| sort -EventCount