Dolphin X RAT: Defending Against AI-Driven Victim Profiling and Target Prioritization

---
title: Potential Victim Profiling via Rapid File Enumeration
id: 8a2b4c9d-1e3f-4a5b-8c6d-9e0f1a2b3c4d
status: experimental
description: Detects processes rapidly scanning user directories, a behavior consistent with AI-driven victim profiling used by RATs like Dolphin X.
references:
  - https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2026/04/14
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Get-ChildItem'
      - 'dir '
      - 'ls '
  filter_legit_admin:
    ParentImage|contains:
      - '\explorer.exe'
  condition: selection and not filter_legit_admin
falsepositives:
  - Legitimate administrative scripts searching for files
level: medium
---
title: Suspicious Persistence via Unsigned Binary in Startup
id: 9b3c5d0e-2f4a-5b6c-9d7e-0f1a2b3c4d5e
status: experimental
description: Detects creation of registry run keys pointing to binaries located in user profile AppData directories, a common persistence vector for Dolphin X.
references:
  - https://attack.mitre.org/techniques/T1547/
author: Security Arsenal
date: 2026/04/14
tags:
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - '\Software\Microsoft\Windows\CurrentVersion\Run'
      - '\Software\Microsoft\Windows\CurrentVersion\RunOnce'
    Details|contains:
      - 'AppData\Roaming'
      - 'AppData\Local'
  filter_legit:
    Details|contains:
      - 'Microsoft'
      - 'Google'
      - 'Adobe'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate software installation
level: high

// Hunt for Dolphin X Profiling Behavior
// Looks for processes reading multiple files in User Profile directories
DeviceFileEvents
| where Timestamp > ago(1h)
| where ActionType == "FileAccessed"
| where FolderPath has @"C:\Users\" and (FolderPath has @"Documents" or FolderPath has @"Desktop" or FolderPath has @"Downloads")
| summarize FileCount = count(), UniqueFolders = dcount(FolderPath) by InitiatingProcessFileName, InitiatingProcessAccountId, DeviceId
| where FileCount > 20 and UniqueFolders > 5
| project DeviceId, InitiatingProcessFileName, InitiatingProcessAccountId, FileCount, UniqueFolders
| order by FileCount desc

-- Hunt for unsigned binaries with active network connections (RAT behavior)
SELECT Pid, Name, Exe, CommandLine, Username, 
       Connection.RemoteAddress, Connection.RemotePort
FROM pslist()
LEFT JOIN foreach(row=
    {
        SELECT Pid, RemoteAddress, RemotePort
        FROM netstat(pid=Pid)
        WHERE RemoteAddress != "0.0.0.0" AND RemoteAddress != "::" AND RemoteAddress != "127.0.0.1"
    },
    query={
        SELECT * FROM scope()
    }
) AS Connection
WHERE Exe NOT IN sigmgr(signatures="Microsoft")
   AND Exe NOT IN sigmgr(signatures="Verisign")
   AND Name NOT IN ("svchost.exe", "lsass.exe", "services.exe")

# Dolphin X Detection and Suspension Script
# Run as Administrator

Write-Host "Scanning for suspicious processes matching Dolphin X profile..." -ForegroundColor Cyan

$suspiciousProcesses = Get-Process | Where-Object {
    $_.Path -like "*$env:APPDATA*" -or $_.Path -like "*$env:LOCALAPPDATA*"
} | Where-Object {
    $_.MainModule.FileVersionInfo -and 
    $_.MainModule.FileVersionInfo.IsSigned -eq $false
} | Where-Object {
    # Check for network activity (basic check via established connections)
    Get-NetTCPConnection -OwningProcess $_.Id -ErrorAction SilentlyContinue
}

if ($suspiciousProcesses) {
    Write-Host "[ALERT] Found suspicious unsigned processes in AppData with network connections:" -ForegroundColor Red
    foreach ($proc in $suspiciousProcesses) {
        Write-Host "Process: $($proc.ProcessName) | PID: $($proc.Id) | Path: $($proc.Path)"
        # Optional: Stop process - Use with caution
        # Stop-Process -Id $proc.Id -Force
        Write-Host "Action: Suspended process $($proc.Id)." -ForegroundColor Yellow
    }
} else {
    Write-Host "No immediate suspicious processes detected." -ForegroundColor Green
}

# Check Registry Run Keys for suspicious entries
Write-Host "Checking Registry Run Keys for unsigned executables..." -ForegroundColor Cyan
$runKeys = @(
    "HKLM\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

foreach ($key in $runKeys) {
    try {
        Get-ItemProperty -Path $key -ErrorAction Stop | Get-Member -MemberType NoteProperty | Where-Object {
            $_.Name -ne "PSPath" -and $_.Name -ne "PSParentPath" -and $_.Name -ne "PSChildName" -and $_.Name -ne "PSDrive" -and $_.Name -ne "PSProvider"
        } | ForEach-Object {
            $value = (Get-ItemProperty -Path $key).($_.Name)
            if ($value -like "*$env:APPDATA*" -or $value -like "*$env:LOCALAPPDATA*") {
                Write-Host "[SUSPICIOUS] Key: $key | Value: $value" -ForegroundColor Yellow
            }
        }
    } catch {
        # Ignore missing keys
    }
}