SparrowDoor backdoor variant with clipboard logging and token impersonation (NCSC MAR)

Key facts

Detection coverage

As of 2026-10-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3849 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SparrowDoor Loader/Backdoor DLLs in ProgramData Microsoft DRM (libcurl.dll / libhost.dll) — Loader Execution

Detects image loads or file creation of the SparrowDoor loader (libcurl.dll) and encoded backdoor/shellcode (libhost.dll) under C:\ProgramData\Microsoft\DRM\ as recovered by the NCSC malware analysis report, the K7-themed side-loaded DLL names from ESET reporting (K7UI.dll, MpSvc.dll, K7AVWScn.dll) when staged in ProgramData, and the known SparrowDoor MD5/SHA1 hashes. The Microsoft\DRM path and the MpSvc.dll name imitate legitimate Microsoft/Defender locations (masquerading), and libhost.dll/MpSvc.dll are encoded shellcode containers that the loader must decode at runtime. Behaviour-first: the path/name pairing is the primary signal; hashes add high-fidelity corroboration for TL-2026-3849.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1574, T1036, T1218, T1140
• Data sources: sysmon, defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h (EventCode=7 OR EventCode=11)
| eval obj=lower(coalesce(ImageLoaded, TargetFilename)), hashes=lower(coalesce(Hashes, ""))
| where match(obj,"programdata.microsoft.drm.(libcurl|libhost)[.]dll$") OR match(obj,"programdata.*(libcurl|libhost|k7ui|mpsvc|k7avwscn)[.]dll$") OR match(hashes,"46077a32e433a56eb8ba64dcbf86bc60|8ad3f513f48f711d573d33b7419e3ed5|bb2f5b573ac7a761015daad0b7ff03b294dc60f6|23e228d5603b4802398b2e7419187aef71ff9dd5|ebc93a546bcdf6cc1eb61d7174bcb85407bbd892")
| stats count, min(_time) as first_seen, values(EventCode) as event_codes, values(Image) as process, values(Hashes) as file_hashes by host, obj
| convert ctime(first_seen)

Microsoft KQL

DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where FolderPath matches regex @"(?i)programdata.microsoft.drm.(libcurl|libhost)\.dll$"
    or (FolderPath has "ProgramData" and FileName in~ ("libcurl.dll", "libhost.dll", "k7ui.dll", "mpsvc.dll", "k7avwscn.dll"))
    or MD5 in~ ("46077a32e433a56eb8ba64dcbf86bc60", "8ad3f513f48f711d573d33b7419e3ed5")
    or SHA1 in~ ("BB2F5B573AC7A761015DAAD0B7FF03B294DC60F6", "23E228D5603B4802398B2E7419187AEF71FF9DD5", "EBC93A546BCDF6CC1EB61D7174BCB85407BBD892")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, FileName, FolderPath, SHA1, MD5, InitiatingProcessAccountName

Sigma

title: SparrowDoor Loader DLL Loaded From ProgramData Microsoft DRM Path
id: 2f6b1c0e-7a43-4d52-9b8e-3c1a5d7e9f01
status: experimental
description: Detects image loads of libcurl.dll or libhost.dll from C:\ProgramData\Microsoft\DRM\ (NCSC SparrowDoor MAR), K7-themed side-loaded DLL names staged in ProgramData (ESET), or known SparrowDoor file hashes.
references:
  - https://www.ncsc.gov.uk/report/mar-sparrowdoor
  - https://www.welivesecurity.com/2021/09/23/famoussparrow-suspicious-hotel-guest/
author: Threadlinqs Team
date: 2026-10-18
tags:
  - attack.defense-evasion
  - attack.persistence
  - attack.t1574.002
  - attack.t1036.005
  - attack.t1218
  - attack.t1140
logsource:
  category: image_load
  product: windows
detection:
  selection_drm:
    ImageLoaded|contains: '\ProgramData\Microsoft\DRM\'
    ImageLoaded|endswith:
      - '\libcurl.dll'
      - '\libhost.dll'
  selection_names:
    ImageLoaded|contains: '\ProgramData\'
    ImageLoaded|endswith:
      - '\k7ui.dll'
      - '\mpsvc.dll'
      - '\k7avwscn.dll'
  selection_hash:
    Hashes|contains:
      - 'MD5=46077A32E433A56EB8BA64DCBF86BC60'
      - 'MD5=8AD3F513F48F711D573D33B7419E3ED5'
      - 'SHA1=BB2F5B573AC7A761015DAAD0B7FF03B294DC60F6'
      - 'SHA1=23E228D5603B4802398B2E7419187AEF71FF9DD5'
      - 'SHA1=EBC93A546BCDF6CC1EB61D7174BCB85407BBD892'
  condition: 1 of selection_*
falsepositives:
  - Legitimate software that ships its own libcurl.dll into a ProgramData directory
level: high

Known false positives:

• Legitimate applications that bundle a libcurl.dll in a ProgramData subdirectory
• Security or software-deployment tools staging DLLs in ProgramData during installation

Tuning notes: Adjust the index name to match your Sysmon index. The generic ProgramData branch is broader than the Microsoft\DRM branch; if noisy, restrict it to unsigned DLLs or allow-list known software publishers. Sysmon must log EventCode 7 (image load) and 11 (file create) with hashes enabled (MD5 and SHA1 in the Hashes field). The NCSC IOC CSV was not retrievable; add its hashes to the hash branch when imported.

• 🔒 Exchange/IIS Worker Process Spawning Shells or Download Utilities — ProxyLogon-Style Initial Access (SparrowDoor Delivery) · unlock with TL Creds
• 🔒 Post-Exploitation Tradecraft — Mimikatz/Token Abuse, Security Software Discovery and DRM Directory Cleanup · unlock with TL Creds
• 🔒 Process Injection / Reflective Loading From ProgramData-Hosted Binaries (SparrowDoor Loader Behaviour) · unlock with TL Creds
• 🔒 K7 Indexer.exe DLL Side-Loading From ProgramData (SparrowDoor Hijack Execution Flow) · unlock with TL Creds
• 🔒 SparrowDoor Run Key Persistence — Indexer.exe -i or ProgramData Autostart · unlock with TL Creds
• 🔒 SparrowDoor C2 Domain Resolution — [indicator] and offices-analytics.com · unlock with TL Creds
• 🔒 SparrowDoor Persistence — WSearchIndex or ProgramData-Hosted Service Creation · unlock with TL Creds
• 🔒 SparrowDoor C2 — Known Infrastructure and ProgramData-Hosted Beaconing over HTTPS · unlock with TL Creds

Indicators of compromise

As of 2026-10-18, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-3849.

Sample indicators (3 of 19)

• IP address: 45.131.179[.]24
• Domain: credits[.]offices-analytics[.]com
• File hash: 46077a32e433a56eb8ba64dcbf86bc60

Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.

Technical analysis

The NCSC (UK) published a malware analysis report on 25 April 2022 covering a variant of SparrowDoor, the backdoor first reported by ESET in September 2021, recovered from a UK network in 2021. The NCSC describes SparrowDoor as a persistent loader and backdoor that uses XOR encoding for the C2 channel underneath HTTPS. Compared with the ESET-documented sample, the variant adds clipboard logging, antivirus (security software) detection, inline hooking of Windows API functions and token impersonation. The loader performs reflective loading of a header-less portable executable payload, and the backdoor supports tasking commands including reading/writing files and opening a reverse shell.

Per secondary reporting of the NCSC report, the recovered files were located in C:\ProgramData\Microsoft\DRM\ and consisted of libcurl.dll (32-bit SparrowDoor loader, MD5 46077a32e433a56eb8ba64dcbf86bc60) and libhost.dll (obfuscated 32-bit SparrowDoor backdoor and shellcode, MD5 8ad3f513f48f711d573d33b7419e3ed5). The NCSC report maps the malware to ATT&CK techniques covering service and Run-key persistence, DLL hijacking (hijack execution flow), process injection, reflective code loading, masquerading, signed binary proxy execution, file deletion, deobfuscation, token manipulation, security software discovery, clipboard collection and exfiltration over C2. The NCSC publishes an IOC CSV, Sigma rules, YARA rules and STIX 2.1 data alongside the PDF; the CSV contents could not be retrieved in this research run, so network indicators specific to the UK sample are not included.

The NCSC page names no threat actor, no CVEs and no CVSS score. ESET separately attributes the SparrowDoor family exclusively to the China-aligned FamousSparrow group (active since at least August 2019), which in 2021 exploited ProxyLogon (from 3 March 2021) and other server flaws, primarily against hotels, governments, law firms, engineering firms and international organizations. ESET's 2021 sample loaded via a hijacked K7 Computing binary (Indexer.exe, K7UI.dll, MpSvc.dll), persisted as the WSearchIndex service or an HKCU Run key, and communicated over HTTPS using multi-byte XOR keys. In 2025 ESET documented two newer SparrowDoor variants (one modular, with parallel command execution). Attribution of the specific UK sample to FamousSparrow is NOT stated by the NCSC and is therefore recorded with LOW confidence. Severity HIGH is an analyst judgement.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003 OS Credential Dumping

Defense Evasion

T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1620 Reflective Code Loading

Command and Control

T1071 Application Layer Protocol; T1573 Encrypted Channel

Privilege Escalation

T1134 Access Token Manipulation

Initial Access

T1190 Exploit Public-Facing Application

Discovery

T1518 Software Discovery

Persistence

T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution

stealth

T1574 Hijack Execution Flow

Remediation

Patches

• Apply vendor patches for ProxyLogon (CVE-2021-26855 and related) on any remaining Exchange servers, the vector ESET documented for earlier SparrowDoor intrusions

Immediate actions

• Deploy the NCSC-published YARA and Sigma rules and import the NCSC IOC CSV / STIX 2.1 data into SIEM and EDR
• Hunt for libcurl.dll and libhost.dll in C:\ProgramData\Microsoft\DRM\ and for the file hashes listed in this record
• Hunt for legitimate signed binaries loading unsigned side-by-side DLLs from C:\ProgramData paths
• Block the network IOCs listed here at the perimeter and review proxy/DNS logs for historical contact

Workarounds

• Application allow-listing to block execution of signed binaries from user-writable ProgramData paths
• Egress filtering and TLS inspection to surface XOR-encoded payloads inside HTTPS sessions

Longer-term hardening

• Alert on creation of new auto-start services and HKCU/HKLM Run keys pointing into ProgramData
• Enable EDR telemetry for reflective loading, inline API hooking and token manipulation behaviours
• Monitor clipboard-access API abuse and credential-dumping tooling on servers
• Restrict and monitor internet-facing IIS/Exchange servers, the initial access vector in ESET-documented SparrowDoor intrusions

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows hosts running 32-bit SparrowDoor loader/backdoor (version-specific scope not stated by NCSC)

Timeline

• 2019-08-01 ESET reports FamousSparrow (exclusive SparrowDoor user) active since at least August 2019
• 2021-03-03 FamousSparrow begins exploiting ProxyLogon Exchange vulnerabilities, per ESET
• 2021-09-23 ESET publishes the first public report on FamousSparrow and the SparrowDoor backdoor
• 2021-12-31 A SparrowDoor variant with clipboard logging, AV detection, inline hooks and token impersonation is found on a UK network (2021; exact date not stated)
• 2022-04-25 NCSC publishes the SparrowDoor malware analysis report with IOC CSV, Sigma, YARA and STIX data (page date; a search snippet showed 2022-02-28, unconfirmed)
• 2024-07-01 FamousSparrow compromises a US trade group and a Mexican research institute with newer SparrowDoor variants and ShadowPad, per ESET (July 2024)
• 2025-03-01 ESET documents two new SparrowDoor variants, one modular, with parallel command execution (March 2025)

Sources cited

• Malware analysis report on SparrowDoor malware (NCSC) NCSC (UK) · Advisory · 2022-04-25
• NCSC MAR SparrowDoor (PDF) NCSC (UK) · Advisory · 2022-04-25
• ESET: You will always remember this as the day you finally caught FamousSparrow ESET WeLiveSecurity · Vendor report · 2025-03-01
• ESET: FamousSparrow - a suspicious hotel guest ESET WeLiveSecurity · Vendor report · 2021-09-23
• The Hacker News: New SparrowDoor backdoor variants found The Hacker News · News · 2025-03-01
• BleepingComputer: Chinese FamousSparrow hackers deploy upgraded malware in attacks BleepingComputer · News · 2025-03-01
• CSO Online: Salt Typhoon may have upgraded backdoors for efficiency and evasion csoonline.com · News · 2025-03-01

More in malware

• Wpcdoor Backdoor Distributed via Korea-Based CMS DVR Management Software (Larva-26013)
• Mirax Android Banking RAT Abuses Accessibility Services for Device Takeover and Bank Fraud in the Middle East, Türkiye and Africa
• RemControl: Android banking trojan MaaS abusing Accessibility Service, AI-assisted phishing overlays (affiliate UNKK)
• Exvicy: ClickFix MaaS Framework Copycat of ErrTraffic Distributing Malware via Compromised WordPress Sites
• Blind Eagle (APT-C-36) Uses Fake Court Notices to Deliver AsyncRAT/DCRat-Lineage RAT Across Latin America

Previous and next in malware

• TrickBot adds Zeus-style webinject configs (winj) to injectDll32/injectDll64 webinject module Previous report
• ToxNetV2: AI-Assisted AArch64 Linux P2P Botnet Controller Using NVIDIA NIM LLM Next report