SparrowDoor Backdoor: NCSC Malware Analysis Report on a Persistent Loader with Clipboard Logging, AV Detection, API Hooking, and Token Impersonation

Key facts for SparrowDoor persistent loader

Detection coverage for SparrowDoor persistent loader

As of 2026-08-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2136 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SparrowDoor Post-Exploitation — Token Impersonation, Clipshot & AV/Recon (Splunk)

Detects SparrowDoor's post-exploitation behaviors on an already-compromised host: SeDebugPrivilege enablement followed by a CreateProcessAsUserA-spawned child process consistent with token impersonation of explorer.exe's logon token; the Clipshot clipboard-logging export invoked via rundll32.exe (child of svchost.exe, command line containing 'curl_easy_init') writing captured clipboard contents to libcurl.dll.log; and the backup HKCU Run-key persistence entry used when service installation fails.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1134.001, T1115, T1518.001, T1082, T1547.001
• Data sources: sysmon, windows_security, wineventlog
• Severity: critical
• Confidence: high

Splunk SPL

index=wineventlog OR index=sysmon
| eval indicator=case(
    sourcetype="WinEventLog:Security" AND EventCode=4703 AND match(PrivilegeList, "(?i)SeDebugPrivilege"), "sedebug_privilege_enabled",
    sourcetype="WinEventLog:Security" AND EventCode=4688 AND match(ParentProcessName, "(?i)\\(SearchIndexer|Indexer)\.exe$"), "createprocessasuser_child_from_sparrowdoor",
    index="sysmon" AND EventCode=1 AND match(ParentImage, "(?i)\\svchost\.exe$") AND match(Image, "(?i)\\rundll32\.exe$") AND match(CommandLine, "(?i)curl_easy_init"), "clipshot_rundll32_invocation",
    index="sysmon" AND EventCode=11 AND match(TargetFilename, "(?i)libcurl\.dll\.log$"), "clipshot_log_file_written",
    index="sysmon" AND EventCode=13 AND match(TargetObject, "(?i)Run\\SearchIndexer"), "searchindexer_runkey_backup_persistence")
| where isnotnull(indicator)
| table _time, host, ParentProcessName, ParentImage, Image, CommandLine, TargetFilename, TargetObject, PrivilegeList, indicator
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "svchost.exe"
  and FileName =~ "rundll32.exe"
  and ProcessCommandLine has "curl_easy_init"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessAccountName
| union (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "libcurl.dll.log"
    | project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName
)
| union (
    DeviceRegistryEvents
    | where Timestamp > ago(24h)
    | where RegistryKey has @"Software\Microsoft\Windows\CurrentVersion\Run"
      and RegistryValueName =~ "SearchIndexer"
    | project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData
)
| union (
    SecurityEvent
    | where TimeGenerated > ago(24h)
    | where (EventID == 4703 and PrivilegeList has "SeDebugPrivilege")
       or (EventID == 4688 and ParentProcessName has_any ("SearchIndexer.exe","Indexer.exe"))
    | project Timestamp=TimeGenerated, DeviceName=Computer, EventID, SubjectUserName, PrivilegeList, ParentProcessName, NewProcessName, CommandLine
)
| sort by Timestamp desc

Sigma

title: SparrowDoor Clipshot Clipboard Logging and Backup Run-Key Persistence
id: 4d8f1a2b-6c3e-4a9f-8b2d-5e6f7a8b9c0d
status: experimental
description: Detects SparrowDoor's Clipshot clipboard-logging export invoked via rundll32.exe spawned from svchost.exe with 'curl_easy_init' in the command line, and the backup HKCU Run-key persistence entry used when service installation fails.
references:
    - https://www.ncsc.gov.uk/report/mar-sparrowdoor
    - https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor-sigma.txt
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-24
tags:
    - attack.collection
    - attack.t1115
    - attack.persistence
    - attack.t1547.001
    - attack.privilege-escalation
    - attack.t1134.001
    - attack.tool.sparrowdoor
    - actor.famoussparrow
logsource:
    category: process_creation
    product: windows
detection:
    selection_clipshot:
        ParentImage|endswith: '\svchost.exe'
        Image|endswith: '\rundll32.exe'
        CommandLine|contains: 'curl_easy_init'
    condition: selection_clipshot
falsepositives:
    - Legitimate use of curl-based rundll32 diagnostic tooling is highly unusual in production fleets; investigate any match
level: high

Known false positives:

• SeDebugPrivilege enablement alone is common for legitimate debuggers/EDR agents — only alert when paired with a CreateProcessAsUserA-style child spawned from an already-suspect SearchIndexer/Indexer lineage.

Tuning notes: Baseline which processes legitimately enable SeDebugPrivilege in your environment (backup agents, EDR, debuggers) and exclude them by signed-binary allowlist rather than by process name alone to avoid trivial evasion.

• 🔒 SparrowDoor Exploitation — Fake SearchIndexer Service & DLL Search-Order Hijack (Sentinel) · unlock with TL Creds
• 🔒 SparrowDoor Post-Exploitation — Token Impersonation, Clipshot & AV/Recon (Sentinel) · unlock with TL Creds
• 🔒 SparrowDoor C2 — XOR-Encoded HTTPS Beacon, Known Infrastructure & Anti-Forensic Uninstall (Sentinel) · unlock with TL Creds
• 🔒 SparrowDoor Exploitation — Fake SearchIndexer Service & DLL Search-Order Hijack (Sigma) · unlock with TL Creds
• 🔒 SparrowDoor Post-Exploitation — Token Impersonation, Clipshot & AV/Recon (Sigma) · unlock with TL Creds
• 🔒 SparrowDoor C2 — XOR-Encoded HTTPS Beacon, Known Infrastructure & Anti-Forensic Uninstall (Sigma) · unlock with TL Creds
• 🔒 SparrowDoor Exploitation — Fake SearchIndexer Service & DLL Search-Order Hijack (Splunk) · unlock with TL Creds
• 🔒 SparrowDoor C2 — XOR-Encoded HTTPS Beacon, Known Infrastructure & Anti-Forensic Uninstall (Splunk) · unlock with TL Creds

Indicators of compromise for SparrowDoor persistent loader

As of 2026-08-24, Threadlinqs Intelligence tracks 18 indicators of compromise for TL-2026-2136.

Sample indicators (3 of 18)

• IP address: 27.102.113[.]240
• Domain: cdn181[.]awsdns-531[.]com
• File hash: 46077a32e433a56eb8ba64dcbf86bc60

Defanged, TLP:CLEAR. Full set of 18 indicators: unlock with TL Creds.

How SparrowDoor persistent loader works

SparrowDoor is a Windows backdoor deployed via DLL search-order hijacking: a legitimate SearchIndexer-family binary loads a malicious loader DLL, which decrypts and executes an XOR-obfuscated shellcode payload from disk. Persistence is dual-layered — primarily as a fake Windows service impersonating the legitimate 'Windows Search Index' component, with a backup HKCU Run-key entry if service installation fails. Post-execution, the malware enters a beacon-and-tasking loop with a variable 3-8 minute inter-beacon sleep (denying operators a fixed periodicity), re-resolves its C2 domain roughly hourly, and shortens its sleep window to 1.5-4 seconds if no tasking has been received for five hours. C2 traffic runs over HTTPS with an additional XOR encoding layer on top (distinct XOR keys for outbound and inbound traffic, and a separate key for on-disk configuration, per ESET's original analysis of the closely related variant).

The UK-network sample analyzed by NCSC extends the malware's capability set beyond what ESET originally documented: a clipboard-logging export ('Clipshot') that is invoked via rundll32.exe (spawned from svchost.exe, command line containing 'curl_easy_init') and writes captured clipboard contents to a log file stored alongside the loader DLL; a routine to detect installed antivirus/security software; inline hooking of Windows API functions (NCSC's report ties the installed hooks to socket-option control and user impersonation); and token impersonation that adjusts the SparrowDoor process's access token — enabling SeDebugPrivilege and using the token associated with explorer.exe — to impersonate the logged-on user before establishing a C2 connection, then spawns child processes under that token via CreateProcessAsUserA. The malware also carries an uninstall routine that removes its persistence mechanisms, terminates spawned child processes, and deletes its own loader/payload files from disk.

Attribution: the NCSC report itself makes no actor attribution. SparrowDoor as a malware family is documented by ESET as used exclusively by FamousSparrow, a China-aligned cyberespionage group active since at least August 2019 that has targeted hotels, government bodies, international organizations, engineering firms, and law firms across at least 12 countries, and which began exploiting the Microsoft Exchange ProxyLogon vulnerability (CVE-2021-26855) on 3 March 2021, one day after the patch was released. Because NCSC characterizes its UK-network sample as structurally and functionally 'very similar' to the ESET-documented variant, the FamousSparrow association is recorded here as an inference from the malware family, not a claim the source document itself makes.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 LSASS Memory

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1070.009 Clear Persistence; T1140 Deobfuscate/Decode Files or Information; T1574.001 DLL

Execution

T1059.003 Windows Command Shell

Command and Control

T1071.001 Web Protocols; T1132.001 Standard Encoding

Discovery

T1082 System Information Discovery; T1518.001 Security Software Discovery

Privilege Escalation

T1134.001 Token Impersonation/Theft

Initial Access

T1190 Exploit Public-Facing Application

Persistence

T1543.003 Windows Service; T1547.001 Registry Run Keys / Startup Folder

Remediation for SparrowDoor persistent loader

Immediate actions

• Deploy the NCSC-published Sigma rules: alert on SearchIndexer.exe spawning svchost.exe, and on svchost.exe spawning rundll32.exe with 'curl_easy_init' in the command line
• Hunt across endpoints for the published SparrowDoor file hashes, the C2 domain cdn181.awsdns-531.com, the mutex Global\gup0, and the libcurl.dll.log clipboard-log artifact
• Isolate and rebuild any host where the fake SearchIndexer service (HKLM\SYSTEM\CurrentControlSet\services\SearchIndexer) or the HKCU Run\SearchIndexer backup key is found

Workarounds

• Block the known C2 domain and file hashes at proxy/EDR/DNS layers
• Restrict Windows service creation to an admin-approved allow-list to prevent masquerading as 'Windows Search Index'

Longer-term hardening

• Monitor for token-impersonation abuse: unexpected SeDebugPrivilege enablement and CreateProcessAsUserA calls using tokens duplicated from explorer.exe
• Enforce code-signing/application allow-listing on service binaries to block DLL search-order hijacking of legitimate indexer/search components
• Baseline and alert on outbound HTTPS traffic with irregular, jittered beacon intervals (3-8 minute sleep, hourly DNS re-resolution) consistent with SparrowDoor's C2 loop

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows Server and desktop editions with the Windows Search Indexer service present

Timeline of SparrowDoor persistent loader

• 2019-08-01 FamousSparrow, the group ESET documents as SparrowDoor's exclusive user, has been active since at least August 2019 (per ESET reporting; not stated in the NCSC report itself).
• 2021-01-01 The SparrowDoor variant that NCSC would later analyze was discovered on a UK network in 2021 (exact date not disclosed in the source).
• 2021-03-03 FamousSparrow began exploiting the Microsoft Exchange ProxyLogon vulnerability (CVE-2021-26855) one day after the patch was released, per ESET's original SparrowDoor reporting.
• 2021-09-23 ESET publishes 'FamousSparrow: A suspicious hotel guest,' the first public technical analysis of the SparrowDoor backdoor.
• 2022-02-28 NCSC's Malware Analysis Report on the UK-network SparrowDoor variant is dated/finalized (matches the Sigma rule metadata date).
• 2022-04-25 NCSC publishes the SparrowDoor Malware Analysis Report, indicator CSV, and Sigma rules on ncsc.gov.uk.

Sources cited for SparrowDoor persistent loader

• Malware analysis report on SparrowDoor malware NCSC (UK) · Advisory · 2022-04-25
• NCSC Malware Analysis Report: SparrowDoor (PDF) NCSC (UK) · Advisory · 2022-02-28
• NCSC MAR SparrowDoor indicators (CSV) NCSC (UK) · Advisory · 2022-02-28
• NCSC MAR SparrowDoor Sigma detection rules NCSC (UK) · Advisory · 2022-02-28
• FamousSparrow: A suspicious hotel guest ESET WeLiveSecurity · Research · 2021-09-23
• You will always remember this as the day you finally caught FamousSparrow ESET WeLiveSecurity · Research · 2025-03-26
• FamousSparrow APT: SparrowDoor Backdoor cyberflorida.org · Blog · 2025-04-01
• Detecting Token Impersonation - Security Spotlight securityboulevard.com · Blog · 2023-11-01

Threats related to SparrowDoor persistent loader

• Spark RAT Campaign Targets Cambodia via BYOVD Abuse of Vulnerable OPSWAT AppRemover Driver (CVE-2026-36425)
• PaperCut NG/MF Chained Zero-Day RCE (CVE-2026-82078 & CVE-2026-81578) Under Active Exploitation
• CL-STA-1062 (UAT-7237) Deploys TinyRCT .NET Backdoor via AppDomainManager Injection Against Southeast Asian Government and Critical Energy Infrastructure

More from Salt Typhoon - G1045

• Talos IR Trends Q3 2026: IT help desk vishing and rising ransomware activity; Salt Typhoon exploiting CVE-2023-20198
• Nation-State Intrusions into Telecom Infrastructure via SS7, BGP Hijacking, and Router Compromise (Salt Typhoon)
• FamousSparrow APT Targets Azerbaijani Oil & Gas Sector via ProxyShell/ProxyNotShell Exchange Exploitation

Previous and next in malware

• CrossC2 Cross-Platform Cobalt Strike Loader Deployed with ReadNimeLoader in Attacks Linked to BlackBasta Infrastructure Previous report
• First Malware Built Specifically for Car Head Units (DoFun TWCore Update-Chain Abuse) Fuels BadBox Botnet Next report