Detect Daemon Tools Lite Embedded Malicious Code (CVE-2026-8398) in Splunk
CVE-2026-8398 is a supply chain compromise affecting Daemon Tools Lite, where threat actors embedded malicious code (CWE-506) within the software distribution. Installations of the trojanized version may result in backdoor access, credential theft, or lateral movement from hosts running the compromised software. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
MITRE ATT&CK
SPL Detection Query
index=endpoint sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", "WinEventLog:Security", "crowdstrike:events:sensor")
| eval parent_lower=lower(ParentImage), image_lower=lower(Image)
| where parent_lower IN ("*\\daemon.exe", "*\\dtlite.exe", "*\\dtagent.exe", "*\\dtshellhlp.exe")
OR image_lower IN ("*\\daemon.exe", "*\\dtlite.exe", "*\\dtagent.exe", "*\\dtshellhlp.exe")
| eval is_suspicious_child=if(parent_lower IN ("*\\daemon.exe", "*\\dtlite.exe", "*\\dtagent.exe", "*\\dtshellhlp.exe") AND NOT image_lower IN ("*\\conhost.exe", "*\\daemon.exe", "*\\dtlite.exe", "*\\dtagent.exe"), 1, 0)
| stats count AS event_count, earliest(_time) AS first_seen, latest(_time) AS last_seen, values(CommandLine) AS command_lines, values(Image) AS child_processes BY host, ParentImage, user
| where is_suspicious_child=1 OR event_count > 0
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - event_countDetects suspicious child process spawning from Daemon Tools Lite binaries using Sysmon process creation events. Targets hosts that may be running the trojanized version of Daemon Tools Lite containing embedded malicious code (CVE-2026-8398).
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate child processes spawned during virtual drive mounting operations
- Software update routines initiated by Daemon Tools Lite phoning home to legitimate update endpoints
- Security tooling that instruments or wraps Daemon Tools processes
- Automated testing environments that use Daemon Tools for disk image management
Other platforms for CVE-2026-8398
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Trojanized Software Child Process Spawning
Expected signal: Sysmon Event ID 1 showing C:\Temp\DTLite.exe spawning cmd.exe as a child process; DeviceProcessEvents in Defender showing the parent-child relationship
- Test 2Simulate Malicious Code Outbound Network Beacon from Daemon Tools Binary
Expected signal: Sysmon Event ID 3 network connection event showing DTAgent.exe (from C:\Temp) making outbound HTTP connection to external IP; DeviceNetworkEvents showing the connection
- Test 3Simulate Embedded Malicious Code Persistence via Registry Run Key
Expected signal: Sysmon Event ID 13 registry value set event for HKCU Run key; Windows Security Event ID 4657 if object access auditing is enabled
- Test 4Verify Daemon Tools Lite Binary Hash Against Known-Good Baseline
Expected signal: File read events for each Daemon Tools binary accessed; output file containing SHA-256 hashes for comparison against vendor advisory
Response Playbook
Triage
- Identify all hosts in the environment with Daemon Tools Lite installed by querying software inventory or endpoint management tooling; cross-reference against the compromised version range once vendor publishes specific build hashes.
- Collect the SHA-256 hash of the installed Daemon Tools Lite executable (DTLite.exe, daemon.exe) on each identified host and compare against known-good hashes published in the vendor's security incident disclosure at https://blog.daemon-tools.cc/post/security-incident.
- Review process creation and network telemetry for all Daemon Tools Lite processes on affected hosts over the prior 30 days to identify any command-and-control beaconing, lateral movement, or persistence mechanisms that may have been established by the embedded malicious code.
- Check for scheduled tasks, registry run keys, or services created by child processes of Daemon Tools Lite binaries that could indicate persistence dropped by the malicious payload.
Containment
- Immediately isolate hosts confirmed to be running the trojanized version of Daemon Tools Lite from the network using EDR isolation capabilities or VLAN segmentation to prevent any active malicious code from communicating with attacker infrastructure or moving laterally.
- Block known malicious IOCs (domains, IPs) associated with the CVE-2026-8398 supply chain compromise at the perimeter firewall and DNS filtering layer; monitor for outbound connections from Daemon Tools Lite processes to non-Daemon vendor infrastructure.
Evidence Collection
- Capture a full memory dump of processes associated with Daemon Tools Lite (DTLite.exe, daemon.exe, DTAgent.exe) on affected hosts prior to remediation to preserve in-memory artifacts such as decrypted payloads, injected code, or network socket state.
- Collect and preserve the original installer binary or update package that introduced the malicious code, along with file system metadata (creation time, modification time, hash) and any downloaded or dropped files in the Daemon Tools installation directory and TEMP folders.
Escalation Criteria
- !Escalate to Incident Response if any Daemon Tools Lite child process is observed making outbound connections to non-Daemon infrastructure, executing encoded PowerShell or scripting commands, or writing files to sensitive directories such as System32 or user credential stores.
- !Escalate immediately if credential access artifacts are found (e.g., LSASS memory reads, access to browser credential stores, SAM/NTDS.dit access) on hosts running the potentially compromised Daemon Tools Lite version, as this indicates the malicious code has progressed beyond initial execution.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
SHA-256 hash of DTLite.exe and daemon.exe installer binaries — compare against vendor-published known-good hashes from the security incident disclosure - >
Windows Prefetch files for daemon.exe, DTLite.exe, and any unusual child processes to establish execution timeline - >
Registry keys under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKCU equivalent for persistence entries created by Daemon Tools child processes - >
Network connection logs showing outbound traffic from Daemon Tools Lite processes to external IPs or domains not associated with daemontools.cc infrastructure - >
File system artifacts in %TEMP%, %APPDATA%, and the Daemon Tools installation directory for dropped secondary payloads
Tuning Guidance
Initial deployment will likely generate alerts on all hosts with Daemon Tools Lite installed regardless of version. Tune by: (1) building an allowlist of known-good SHA-256 hashes for clean Daemon Tools Lite versions and suppressing alerts for hosts where the binary hash matches; (2) scoping child-process detections to exclude conhost.exe and known Daemon Tools helper binaries documented by the vendor; (3) adding network allowlists for Daemon Tools update domains (daemontools.cc, daemon-tools.cc) to reduce false positives from legitimate update checks. Increase confidence to 'high' once vendor publishes specific compromised build identifiers.
Hunting Queries
Threat hunt for files written outside expected Daemon Tools directories by Daemon Tools Lite processes, which may reveal dropped secondary payloads from embedded malicious code.
DeviceFileEvents
| where InitiatingProcessFileName in~ ("daemon.exe", "DTLite.exe", "DTAgent.exe", "DTShellHlp.exe")
| where FolderPath !startswith @"C:\Program Files\DAEMON Tools"
| where FolderPath !startswith @"C:\Windows\Temp"
| where FileName !endswith ".log"
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp descindex=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| where lower(Image) IN ("*\\daemon.exe", "*\\dtlite.exe", "*\\dtagent.exe", "*\\dtshellhlp.exe")
| where NOT TargetFilename LIKE "%DAEMON Tools%"
| where NOT TargetFilename LIKE "%.log"
| stats count AS file_write_count, values(TargetFilename) AS files_written BY host, Image, User
| sort - file_write_countAtomic Red Team Tests
Simulates the behavior of embedded malicious code launching a secondary payload as a child process of a legitimate application, mimicking CVE-2026-8398 execution pattern.
Command
# LAB ONLY — rename powershell to DTLite.exe in a temp dir to simulate parent process
copy C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Temp\DTLite.exe
C:\Temp\DTLite.exe -NoProfile -Command "Start-Process cmd.exe -ArgumentList '/c whoami > C:\Temp\malcode_output.txt'"Cleanup
Remove-Item C:\Temp\DTLite.exe -Force; Remove-Item C:\Temp\malcode_output.txt -ForceExpected Telemetry
Sysmon Event ID 1 showing C:\Temp\DTLite.exe spawning cmd.exe as a child process; DeviceProcessEvents in Defender showing the parent-child relationship
Expected Detection
Detection rule triggers on child process (cmd.exe) spawned by process named DTLite.exe that is not in the expected Daemon Tools installation path
Simulates embedded malicious code initiating outbound C2 communication from a process named after a Daemon Tools Lite binary.
Command
# LAB ONLY — rename curl to DTAgent.exe to simulate network activity from daemon process
copy C:\Windows\System32\curl.exe C:\Temp\DTAgent.exe
C:\Temp\DTAgent.exe -s http://example.com/beacon_test -o C:\Temp\beacon_response.txtCleanup
Remove-Item C:\Temp\DTAgent.exe -Force; Remove-Item C:\Temp\beacon_response.txt -ForceExpected Telemetry
Sysmon Event ID 3 network connection event showing DTAgent.exe (from C:\Temp) making outbound HTTP connection to external IP; DeviceNetworkEvents showing the connection
Expected Detection
Network-based detection rule triggers on outbound connection from DTAgent.exe to non-Daemon Tools infrastructure
Simulates a common post-exploitation persistence technique that embedded malicious code in CVE-2026-8398 may use to survive reboots.
Command
# LAB ONLY — simulate persistence key creation as if spawned by Daemon Tools
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DaemonUpdater" /t REG_SZ /d "C:\Temp\malicious_payload.exe" /f
echo Persistence key created for simulationCleanup
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DaemonUpdater" /fExpected Telemetry
Sysmon Event ID 13 registry value set event for HKCU Run key; Windows Security Event ID 4657 if object access auditing is enabled
Expected Detection
Registry persistence detection rule or threat hunt query identifies new Run key value pointing to executable outside standard program directories
Validates detection of tampered Daemon Tools Lite binaries by comparing file hashes against the vendor's known-good baseline, simulating the triage step for CVE-2026-8398.
Command
# Run on a host with Daemon Tools Lite installed
$dtPath = "C:\Program Files\DAEMON Tools Lite"
Get-ChildItem -Path $dtPath -Include *.exe -Recurse | ForEach-Object {
$hash = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
Write-Output "$($_.Name): $hash"
} | Out-File C:\Temp\daemon_tools_hashes.txt
Get-Content C:\Temp\daemon_tools_hashes.txtCleanup
Remove-Item C:\Temp\daemon_tools_hashes.txt -ForceExpected Telemetry
File read events for each Daemon Tools binary accessed; output file containing SHA-256 hashes for comparison against vendor advisory
Expected Detection
Hash mismatch between collected hashes and vendor-published known-good hashes indicates presence of trojanized binaries consistent with CVE-2026-8398