# SparrowDoor Backdoor: NCSC Malware Analysis Report on a Persistent Loader with Clipboard Logging, AV Detection, API Hooking, and Token Impersonation

> NCSC UK published a Malware Analysis Report (dated 28 February 2022, published 25 April 2022) on SparrowDoor, a persistent loader-and-backdoor discovered on a UK network in 2021 that XOR-encodes its C2 channel underneath HTTPS. Compared to the SparrowDoor variant ESET first documented in September 2021, this UK sample adds clipboard logging ('Clipshot'), an antivirus-detection routine, inline hooking of Windows API functions, and token impersonation.

- **Published:** 2026-08-24T00:00:00Z
- **Last reviewed:** 2026-08-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2136
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-sparrowdoor-persistent-loader-tl-2026-2136.webp?v=d40cd9c8 (Threadlinqs threat intel: SparrowDoor Loader: Detection & IOCs (TL-2026-2136) — Medium severity, 18 IOCs, 9 detection rules.)
- **ID:** TL-2026-2136
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Salt Typhoon - G1045 (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 18 (3 shown free below)

## Description

SparrowDoor is a Windows backdoor deployed via DLL search-order hijacking: a legitimate SearchIndexer-family binary loads a malicious loader DLL, which decrypts and executes an XOR-obfuscated shellcode payload from disk. Persistence is dual-layered — primarily as a fake Windows service impersonating the legitimate 'Windows Search Index' component, with a backup HKCU Run-key entry if service installation fails. Post-execution, the malware enters a beacon-and-tasking loop with a variable 3-8 minute inter-beacon sleep (denying operators a fixed periodicity), re-resolves its C2 domain roughly hourly, and shortens its sleep window to 1.5-4 seconds if no tasking has been received for five hours. C2 traffic runs over HTTPS with an additional XOR encoding layer on top (distinct XOR keys for outbound and inbound traffic, and a separate key for on-disk configuration, per ESET's original analysis of the closely related variant).

The UK-network sample analyzed by NCSC extends the malware's capability set beyond what ESET originally documented: a clipboard-logging export ('Clipshot') that is invoked via rundll32.exe (spawned from svchost.exe, command line containing 'curl_easy_init') and writes captured clipboard contents to a log file stored alongside the loader DLL; a routine to detect installed antivirus/security software; inline hooking of Windows API functions (NCSC's report ties the installed hooks to socket-option control and user impersonation); and token impersonation that adjusts the SparrowDoor process's access token — enabling SeDebugPrivilege and using the token associated with explorer.exe — to impersonate the logged-on user before establishing a C2 connection, then spawns child processes under that token via CreateProcessAsUserA. The malware also carries an uninstall routine that removes its persistence mechanisms, terminates spawned child processes, and deletes its own loader/payload files from disk.

Attribution: the NCSC report itself makes no actor attribution. SparrowDoor as a malware family is documented by ESET as used exclusively by FamousSparrow, a China-aligned cyberespionage group active since at least August 2019 that has targeted hotels, government bodies, international organizations, engineering firms, and law firms across at least 12 countries, and which began exploiting the Microsoft Exchange ProxyLogon vulnerability (CVE-2021-26855) on 3 March 2021, one day after the patch was released. Because NCSC characterizes its UK-network sample as structurally and functionally 'very similar' to the ESET-documented variant, the FamousSparrow association is recorded here as an inference from the malware family, not a claim the source document itself makes.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.003 Windows Command Shell
- T1543.003 Windows Service
- T1547.001 Registry Run Keys / Startup Folder
- T1134.001 Token Impersonation/Theft
- T1574.001 DLL
- T1036.005 Match Legitimate Resource Name or Location
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1070.004 File Deletion
- T1070.009 Clear Persistence
- T1003.001 LSASS Memory
- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1071.001 Web Protocols
- T1132.001 Standard Encoding

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SparrowDoor Post-Exploitation — Token Impersonation, Clipshot & AV/Recon (Splunk)** (`TL-2026-2136-SPL-002`)

Detects SparrowDoor's post-exploitation behaviors on an already-compromised host: SeDebugPrivilege enablement followed by a CreateProcessAsUserA-spawned child process consistent with token impersonation of explorer.exe's logon token; the Clipshot clipboard-logging export invoked via rundll32.exe (child of svchost.exe, command line containing 'curl_easy_init') writing captured clipboard contents to libcurl.dll.log; and the backup HKCU Run-key persistence entry used when service installation fails.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1134.001, T1115, T1518.001, T1082, T1547.001
- **Data sources:** sysmon, windows_security, wineventlog
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=wineventlog OR index=sysmon
| eval indicator=case(
    sourcetype="WinEventLog:Security" AND EventCode=4703 AND match(PrivilegeList, "(?i)SeDebugPrivilege"), "sedebug_privilege_enabled",
    sourcetype="WinEventLog:Security" AND EventCode=4688 AND match(ParentProcessName, "(?i)\\(SearchIndexer|Indexer)\.exe$"), "createprocessasuser_child_from_sparrowdoor",
    index="sysmon" AND EventCode=1 AND match(ParentImage, "(?i)\\svchost\.exe$") AND match(Image, "(?i)\\rundll32\.exe$") AND match(CommandLine, "(?i)curl_easy_init"), "clipshot_rundll32_invocation",
    index="sysmon" AND EventCode=11 AND match(TargetFilename, "(?i)libcurl\.dll\.log$"), "clipshot_log_file_written",
    index="sysmon" AND EventCode=13 AND match(TargetObject, "(?i)Run\\SearchIndexer"), "searchindexer_runkey_backup_persistence")
| where isnotnull(indicator)
| table _time, host, ParentProcessName, ParentImage, Image, CommandLine, TargetFilename, TargetObject, PrivilegeList, indicator
| sort -_time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "svchost.exe"
  and FileName =~ "rundll32.exe"
  and ProcessCommandLine has "curl_easy_init"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessAccountName
| union (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "libcurl.dll.log"
    | project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName
)
| union (
    DeviceRegistryEvents
    | where Timestamp > ago(24h)
    | where RegistryKey has @"Software\Microsoft\Windows\CurrentVersion\Run"
      and RegistryValueName =~ "SearchIndexer"
    | project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData
)
| union (
    SecurityEvent
    | where TimeGenerated > ago(24h)
    | where (EventID == 4703 and PrivilegeList has "SeDebugPrivilege")
       or (EventID == 4688 and ParentProcessName has_any ("SearchIndexer.exe","Indexer.exe"))
    | project Timestamp=TimeGenerated, DeviceName=Computer, EventID, SubjectUserName, PrivilegeList, ParentProcessName, NewProcessName, CommandLine
)
| sort by Timestamp desc
```

### Sigma

```yaml
title: SparrowDoor Clipshot Clipboard Logging and Backup Run-Key Persistence
id: 4d8f1a2b-6c3e-4a9f-8b2d-5e6f7a8b9c0d
status: experimental
description: Detects SparrowDoor's Clipshot clipboard-logging export invoked via rundll32.exe spawned from svchost.exe with 'curl_easy_init' in the command line, and the backup HKCU Run-key persistence entry used when service installation fails.
references:
    - https://www.ncsc.gov.uk/report/mar-sparrowdoor
    - https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor-sigma.txt
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-24
tags:
    - attack.collection
    - attack.t1115
    - attack.persistence
    - attack.t1547.001
    - attack.privilege-escalation
    - attack.t1134.001
    - attack.tool.sparrowdoor
    - actor.famoussparrow
logsource:
    category: process_creation
    product: windows
detection:
    selection_clipshot:
        ParentImage|endswith: '\svchost.exe'
        Image|endswith: '\rundll32.exe'
        CommandLine|contains: 'curl_easy_init'
    condition: selection_clipshot
falsepositives:
    - Legitimate use of curl-based rundll32 diagnostic tooling is highly unusual in production fleets; investigate any match
level: high
```

**Known false positives:**

- SeDebugPrivilege enablement alone is common for legitimate debuggers/EDR agents — only alert when paired with a CreateProcessAsUserA-style child spawned from an already-suspect SearchIndexer/Indexer lineage.

**Tuning notes:** Baseline which processes legitimately enable SeDebugPrivilege in your environment (backup agents, EDR, debuggers) and exclude them by signed-binary allowlist rather than by process name alone to avoid trivial evasion.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SparrowDoor Exploitation — Fake SearchIndexer Service & DLL Search-Order Hijack (Sentinel) (locked: unlock with TL Creds)
- SparrowDoor Post-Exploitation — Token Impersonation, Clipshot & AV/Recon (Sentinel) (locked: unlock with TL Creds)
- SparrowDoor C2 — XOR-Encoded HTTPS Beacon, Known Infrastructure & Anti-Forensic Uninstall (Sentinel) (locked: unlock with TL Creds)
- SparrowDoor Exploitation — Fake SearchIndexer Service & DLL Search-Order Hijack (Sigma) (locked: unlock with TL Creds)
- SparrowDoor Post-Exploitation — Token Impersonation, Clipshot & AV/Recon (Sigma) (locked: unlock with TL Creds)
- SparrowDoor C2 — XOR-Encoded HTTPS Beacon, Known Infrastructure & Anti-Forensic Uninstall (Sigma) (locked: unlock with TL Creds)
- SparrowDoor Exploitation — Fake SearchIndexer Service & DLL Search-Order Hijack (Splunk) (locked: unlock with TL Creds)
- SparrowDoor C2 — XOR-Encoded HTTPS Beacon, Known Infrastructure & Anti-Forensic Uninstall (Splunk) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 18)

Defanged, TLP:CLEAR.

- IP address: `27.102.113[.]240`
- Domain: `cdn181[.]awsdns-531[.]com`
- File hash: `46077a32e433a56eb8ba64dcbf86bc60`

Full set of 18 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Malware analysis report on SparrowDoor malware](https://www.ncsc.gov.uk/report/mar-sparrowdoor)
- [NCSC Malware Analysis Report: SparrowDoor (PDF)](https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf)
- [NCSC MAR SparrowDoor indicators (CSV)](https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor-indicators.csv)
- [NCSC MAR SparrowDoor Sigma detection rules](https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor-sigma.txt)
- [FamousSparrow: A suspicious hotel guest](https://www.welivesecurity.com/2021/09/23/famoussparrow-suspicious-hotel-guest/)
- [You will always remember this as the day you finally caught FamousSparrow](https://www.welivesecurity.com/en/eset-research/you-will-always-remember-this-as-the-day-you-finally-caught-famoussparrow/)
- [FamousSparrow APT: SparrowDoor Backdoor](https://cyberflorida.org/famoussparrow-apt-sparrowdoor-backdoor/)
- [Detecting Token Impersonation - Security Spotlight](https://securityboulevard.com/2023/11/detecting-token-impersonation-security-spotlight/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2136