Operation DragonReturn: Detecting DcRAT via Fake Indian Tax Filing Utilities

---
title: Potential Fake Tax Utility Execution
id: 9c2f8d12-5a6b-4f7c-9e1d-3a5b6c7d8e9f
status: experimental
description: Detects execution of binaries with tax-related keywords (Tax, Income, ITR) originating from user directories, indicative of the Operation DragonReturn lure.
references:
 - https://thehackernews.com/2026/07/suspected-china-nexus-hackers-use-fake.html
author: Security Arsenal
date: 2026/07/15
tags:
 - attack.initial_access
 - attack.t1566.001
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   Image|contains:
     - '\Downloads\'
     - '\AppData\Local\Temp\'
   Image|endswith:
     - '.exe'
     - '.bat'
     - '.cmd'
   CommandLine|contains:
     - 'Tax'
     - 'Income'
     - 'ITR'
     - 'Utility'
 filter:
   Image|contains:
     - '\Microsoft\'
     - '\Program Files\'
     - '\Program Files (x86)\'
     - '\System32\'
falsepositives:
 - Legitimate tax software installation by administrators
 - Temporary installer files
level: high
---
title: Suspicious Parent Process Spawning PowerShell
id: b4e1a9c3-7d2f-4e5b-9a1c-2d3e4f5a6b7c
status: experimental
description: Detects a suspicious parent process (like a fake utility) spawning PowerShell, common in DcRAT execution chains for defense evasion.
references:
 - https://attack.mitre.org/techniques/T1059/001
author: Security Arsenal
date: 2026/07/15
tags:
 - attack.execution
 - attack.t1059.001
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   ParentImage|contains:
     - '\Downloads\'
     - '\Users\'
   Image|endswith:
     - '\powershell.exe'
   CommandLine|contains:
     - 'DownloadString'
     - 'IEX'
     - 'Encrypted'
falsepositives:
 - Administrative scripts run from user profiles
level: medium

// Hunt for Operation DragonReturn DcRAT Lures
// Looks for executables with tax-related keywords spawned by email clients or browsers
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("outlook.exe", "winword.exe", "excel.exe", "chrome.exe", "msedge.exe", "firefox.exe")
| where FileName endswith ".exe"
| where ProcessCommandLine has_any ("Tax", "Income", "ITR", "Return", "Utility", "India")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath
| order by Timestamp desc

-- Hunt for suspicious tax-related executables in user directories
SELECT 
  FullPath, 
  Size, 
  Mtime, 
  Mode.String AS Mode
FROM glob(globs="C:/Users/*/Downloads/*Tax*.exe")

UNION ALL

SELECT 
  FullPath, 
  Size, 
  Mtime, 
  Mode.String AS Mode
FROM glob(globs="C:/Users/*/Downloads/*Income*.exe")

UNION ALL

-- Check for persistence in Registry Run keys associated with Tax names
SELECT 
  key.path AS KeyPath, 
  data.value AS Value, 
  key.mtime AS ModifiedTime
FROM registry_glob(globs="HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Run/*")
WHERE Value =~ "Tax" OR Value =~ "Income" OR Value =~ "ITR"

# Operation DragonReturn Remediation Script
# Scans for suspicious executables in user profiles and checks for suspicious persistence

Write-Host "Starting scan for Operation DragonReturn indicators..." -ForegroundColor Cyan

# Define suspicious keywords
$Keywords = @("Tax", "Income", "ITR", "Utility", "Refund")
$SuspiciousFiles = @()
$UserProfiles = Get-ChildItem -Path "C:\Users" -Directory

foreach ($Profile in $UserProfiles) {
    # Check Downloads
    $DownloadsPath = Join-Path -Path $Profile.FullName -ChildPath "Downloads"
    if (Test-Path $DownloadsPath) {
        Get-ChildItem -Path $DownloadsPath -File -ErrorAction SilentlyContinue | ForEach-Object {
            if ($_.Name -match "($($Keywords -join '|'))") {
                $SuspiciousFiles += $_.FullName
            }
        }
    }

    # Check Desktop
    $DesktopPath = Join-Path -Path $Profile.FullName -ChildPath "Desktop"
    if (Test-Path $DesktopPath) {
        Get-ChildItem -Path $DesktopPath -File -ErrorAction SilentlyContinue | ForEach-Object {
            if ($_.Name -match "($($Keywords -join '|'))") {
                $SuspiciousFiles += $_.FullName
            }
        }
    }
}

if ($SuspiciousFiles.Count -gt 0) {
    Write-Host "WARNING: Found suspicious files:" -ForegroundColor Red
    $SuspiciousFiles | ForEach-Object { Write-Host $_ -ForegroundColor Yellow }
    
    # Optional: Quarantine/Remove (Uncomment to execute)
    # $SuspiciousFiles | ForEach-Object { Remove-Item -Path $_ -Force -WhatIf }
} else {
    Write-Host "No suspicious files found matching keywords." -ForegroundColor Green
}

# Check Registry for suspicious Run keys
Write-Host "Checking Registry Run keys for suspicious persistence..." -ForegroundColor Cyan
$RunKeys = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
)

foreach ($Key in $RunKeys) {
    if (Test-Path $Key) {
        Get-ItemProperty -Path $Key -ErrorAction SilentlyContinue | Get-Member -MemberType NoteProperty | Where-Object {$_.Name -ne "PSPath" -and $_.Name -ne "PSParentPath" -and $_.Name -ne "PSChildName"} | ForEach-Object {
            $PropName = $_.Name
            $PropValue = (Get-ItemProperty -Path $Key).$PropName
            if ($PropValue -match "($($Keywords -join '|'))") {
                Write-Host "Suspicious Registry Entry found in $Key : $PropName = $PropValue" -ForegroundColor Red
            }
        }
    }
}

Write-Host "Scan complete." -ForegroundColor Cyan