DAEMON Tools Supply Chain Attack: Detection and Remediation for Trojanized Installers

---
title: DAEMON Tools Installer Spawning Suspicious Shell
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects DAEMON Tools installers spawning command shells or PowerShell immediately after execution, indicative of malicious payload execution.
references:
  - https://thehackernews.com/2026/05/daemon-tools-supply-chain-attack.html
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\DAEMONTools.exe'
      - '\DTLite.exe'
      - '\setup.exe'
    ParentCommandLine|contains:
      - 'DAEMON Tools'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate administrative script execution by the software (rare)
level: high
---
title: Suspicious Network Connection from DAEMON Tools Installer
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the DAEMON Tools installer process initiating network connections to non-standard ports or IPs, typical for C2 beacons.
references:
  - https://thehackernews.com/2026/05/daemon-tools-supply-chain-attack.html
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\DAEMONTools.exe'
      - '\DTLite.exe'
      - '\setup.exe'
    DestinationPort|not:
      - 80
      - 443
      - 8080
  condition: selection
falsepositives:
  - Legitimate update checks to vendor domains on standard ports
level: high

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("DAEMONTools.exe", "DTLite.exe", "setup.exe") 
| extend InitiatingProcessCommandLine = tostring(InitiatingProcessCommandLine)
| where InitiatingProcessCommandLine contains "DAEMON"
| where FileName in~ ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "regsvr32.exe", "rundll32.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath
| order by Timestamp desc

-- Hunt for DAEMON Tools installer files created recently
SELECT FullPath, Size, Mtime, Atime,
       hash(path=FullPath) AS Hash
FROM glob(globs="C:\Users\*\Downloads\*.exe", root=string("/"))
WHERE FullPath =~ "(?i)(daemon|dtools).*setup.*\.exe"
  AND Mtime > now() - 30d
-- Optionally check if the file is signed but suspicious

<#
.SYNOPSIS
    Detect and remove potentially compromised DAEMON Tools installers.
.DESCRIPTION
    Scans user download directories for DAEMON Tools installers created within the last 30 days
    and logs findings for remediation.
#>

$LogPath = "C:\Windows\Temp\DAEMON_Tools_Re mediation.log"
$DaysToLookBack = 30
$CutoffDate = (Get-Date).AddDays(-$DaysToLookBack)

Function Write-Log {
    param ([string]$message)
    Add-Content -Path $LogPath -Value "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') - $message"
}

Write-Log "Starting scan for DAEMON Tools installers."

$UserProfiles = Get-ChildItem "C:\Users" -Directory

foreach ($Profile in $UserProfiles) {
    $DownloadPath = Join-Path $Profile.FullName "Downloads"
    
    if (Test-Path $DownloadPath) {
        Write-Log "Scanning directory: $DownloadPath"
        
        # Look for executables matching common DAEMON Tools installer names
        $SuspiciousFiles = Get-ChildItem -Path $DownloadPath -Filter "*.exe" -File | 
                           Where-Object { $_.Name -match "(?i)daemon|dtools|setup" -and $_.CreationTime -gt $CutoffDate }
        
        foreach ($File in $SuspiciousFiles) {
            Write-Log "Potentially compromised installer found: $($File.FullName)"
            
            # Verify Authenticode signature status
            $Signature = Get-AuthenticodeSignature -FilePath $File.FullName
            
            if ($Signature.Status -eq 'Valid') {
                Write-Log "WARNING: File is signed by $($Signature.SignerCertificate.Subject). Malware is using valid certs."
            }
            
            # Quarantine/Remove action (Uncomment to enforce)
            # Remove-Item -Path $File.FullName -Force -ErrorAction SilentlyContinue
            # Write-Log "Removed file: $($File.FullName)"
        }
    }
}

Write-Log "Scan complete."