Malware creates the MSDCSC directory, which is a common path utilized by DarkComet, as well as the mutex pattern.

Hunt Hypothesis

This hunt targets adversaries deploying DarkComet or similar malware that establish persistence and evade detection by creating the specific MSDCSC directory and associated mutex patterns within Windows environments. Proactively hunting for these artifacts in Azure Sentinel is critical to identify early-stage infections before they escalate, as this low-severity indicator often precedes more aggressive command-and-control activities.

YARA Rule

rule DarkComet_5
{ 
	meta:
		maltype = "DarkComet RAT"
		author = "https://github.com/reed1713"
		description = "Malware creates the MSDCSC directory, which is a common path utilized by DarkComet, as well as the mutex pattern."
	strings:
		$type="Microsoft-Windows-Security-Auditing"
		$eventid="4688"
		$data=/AppData\\Local\\Temp\\MSDCSC\\.+\.exe/

		$type1="Microsoft-Windows-Security-Auditing"
		$eventid1="4674"
		$data1=/DC_MUTEX-[0-9A-Z]{7}/
	condition:
		($type and $eventid and $data) or ($type1 and $eventid1 and $data1)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Malware creates the MSDCSC directory / DarkComet Mutex detection rule, including suggested filters and exclusions:

• Microsoft Defender Antivirus Real-Time Protection Updates

  • Scenario: The Microsoft Defender service (MsMpEng.exe) frequently performs background scans or updates its definition database. During these operations, it may create temporary working directories under C:\ProgramData\MSDCSC (or similar paths) to stage files before deployment, inadvertently triggering the directory creation logic and establishing a mutex for synchronization.
  • Filter/Exclusion: Exclude process names matching MsMpEng.exe, Sense.exe, or MpCmdRun.exe running from the C:\Program Files\Windows Defender path. Additionally, filter out events where the parent process is svchost.exe with the service name WinDefend.

• Third-Party Endpoint Detection and Response (EDR) Agents

  • Scenario: Enterprise security suites like CrowdStrike Falcon (csagent.exe), Carbon Black (cb.exe), or SentinelOne (S1Service.exe) often utilize the MSDCSC directory structure for their own telemetry collection, policy caching, or quarantine storage. These agents create mutexes to manage file locking during high-frequency scanning cycles.
  • Filter/Exclusion: Create a whitelist exclusion for known EDR executables (e.g., csagent.exe, cb.exe, S1Service.exe) and their specific installation paths. Verify that the creating process has a valid digital signature from the respective vendor (CrowdStrike, VMware, SentinelOne).

• Scheduled System Maintenance via PowerShell or Task Scheduler

  • Scenario: IT administrators often deploy scheduled maintenance scripts using PowerShell (powershell.exe) or cmd.exe to clean up temporary files or rotate logs. A script