Supply Chain Attack: DAEMON Tools Installers Trojanized to Deploy Backdoor

---
title: DAEMON Tools Installer Spawning Suspicious Child Process
id: 8c5d1a23-9f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects DAEMON Tools installer spawning suspicious shell processes often used for payload delivery.
references:
  - https://www.bleepingcomputer.com/news/security/daemon-tools-trojanized-in-supply-chain-attack-to-deploy-backdoor/
author: Security Arsenal
date: 2024/04/09
tags:
  - attack.initial_access
  - attack.t1195
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - 'dtools'
      - 'DTInst'
      - 'DAEMON Tools'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate administrative use of the installer (unlikely to spawn cmd/ps)
level: high
---
title: Suspicious Network Connection from DAEMON Tools Installer
id: 9e6f2c84-0e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects the DAEMON Tools installer process establishing outbound network connections to non-standard ports, indicative of C2 beacons.
references:
  - https://www.bleepingcomputer.com/news/security/daemon-tools-trojanized-in-supply-chain-attack-to-deploy-backdoor/
author: Security Arsenal
date: 2024/04/09
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|contains:
      - 'dtools'
      - 'DTInst'
    Initiated: 'true'
    DestinationPort|notin:
      - 80
      - 443
      - 8080
  condition: selection
falsepositives:
  - Rare, legitimate installer update checks (usually use 80/443)
level: high

DeviceProcessEvents
| where InitiatingProcessFileName has_any ("dtools", "DTInst", "DAEMON") 
| where ProcessFileName in~ ("powershell.exe", "cmd.exe", "powershell_ise.exe", "pwsh.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, FolderPath
| order by Timestamp desc

-- Hunt for DAEMON Tools installer files created recently
SELECT FullPath, Size, Mtime, Atime, Mode
FROM glob(globs="C:/Users/*/Downloads/*dtools*.exe")
WHERE Mtime > timestamp("2024-04-01")

-- Hunt for running processes that might be the backdoor child
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ "powershell" AND Exe =~ "WindowsPowerShell"
  AND Parent.Name =~ "dtools"

<#
.SYNOPSIS
    Response script for DAEMON Tools Supply Chain Attack.
.DESCRIPTION
    Identifies DAEMON Tools installer files downloaded after April 8, 2024, 
    and checks for suspicious child processes.
#>

$CompromiseDate = Get-Date "2024-04-08"
$PathsToCheck = @("C:\Users\*\Downloads\", "C:\ProgramData\", "$env:TEMP")

Write-Host "[*] Scanning for DAEMON Tools installers modified after $($CompromiseDate.ToShortDateString())..."

$SuspiciousFiles = @()
foreach ($path in $PathsToCheck) {
    $files = Get-ChildItem -Path $path -Filter "*dtools*.exe" -Recurse -ErrorAction SilentlyContinue
    foreach ($file in $files) {
        if ($file.LastWriteTime -gt $CompromiseDate) {
            Write-Host "[!] Suspicious installer found: $($file.FullName) (Modified: $($file.LastWriteTime))" -ForegroundColor Red
            $SuspiciousFiles += $file
        }
    }
}

if ($SuspiciousFiles.Count -eq 0) {
    Write-Host "[+] No suspicious installers found in common paths." -ForegroundColor Green
} else {
    Write-Host "[!] Recommendation: Quarantine or delete the files listed above immediately." -ForegroundColor Yellow
}

# Check for suspicious parent-child relationships
Write-Host "[*] Checking process tree for installer spawning shells..."
$Processes = Get-WmiObject Win32_Process | Select-Object Name, ProcessId, ParentProcessId, CommandLine
$ParentMap = @{}
foreach ($p in $Processes) { $ParentMap[$p.ProcessId] = $p.Name }

foreach ($p in $Processes) {
    if ($p.Name -match "powershell|cmd|wscript|cscript") {
        $ParentName = ""
        if ($ParentMap.ContainsKey($p.ParentProcessId)) {
            $ParentName = $ParentMap[$p.ParentProcessId]
        }
        if ($ParentName -match "dtools|DTInst|DAEMON") {
            Write-Host "[!] Suspicious execution: Parent $($ParentName) spawned child $($p.Name)" -ForegroundColor Red
            Write-Host "    Command: $($p.CommandLine)"
        }
    }
}