Candiru Spyware Delivered Through Ad Networks: Detecting and Defending Against the Discover-Tech Zero-Click Campaign

---
title: Browser Process Spawning Shell or Script Interpreter
description: Detects web browsers spawning cmd, PowerShell, rundll32, regsvr32, or other LOLBins — a hallmark of browser exploit chain post-exploitation, consistent with ad-delivered zero-click spyware such as Candiru/DevilsTongue.
references:
  - https://www.securityweek.com/israeli-ad-firm-doubled-as-candirus-zero-click-spyware-delivery-channel/
  - https://attack.mitre.org/techniques/T1189/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\opera.exe'
      - '\iexplore.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmiprvse.exe'
      - '\schtasks.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare browser-integrated enterprise tooling; investigate parent-child pairs before whitelisting
level: high
---
title: COM Hijack Persistence via Missing TreatAs or Delegate Keys
description: Detects registry writes consistent with COM hijacking persistence, a technique Microsoft documented in Candiru's DevilsTongue implant for surviving reboots without touching common autorun locations.
references:
  - https://www.securityweek.com/israeli-ad-firm-doubled-as-candirus-zero-click-spyware-delivery-channel/
  - https://attack.mitre.org/techniques/T1546/015/
author: Security Arsenal
status: experimental
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - '\Software\Classes\CLSID\'
    TargetObject|endswith:
      - '\TreatAs\'
      - '\InprocServer32\'
      - '\LocalServer32\'
    Details|contains:
      - '\Users\'
      - '\AppData\'
      - '\ProgramData\'
  filter_known_updaters:
    Image|endswith:
      - '\msiexec.exe'
      - '\setup.exe'
  condition: selection and not filter_known_updaters
falsepositives:
  - Legitimate per-user application installs registering COM objects under HKCU
level: high
---
title: Implant-Like Network Beacon from Unsigned User-Directory Binary
description: Detects outbound HTTPS connections from unsigned executables running from user-writable directories shortly after system boot or browser activity — matching DevilsTongue-style implants that stage payloads in AppData and beacon over HTTPS.
references:
  - https://www.securityweek.com/israeli-ad-firm-doubled-as-candirus-zero-click-spyware-delivery-channel/
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
status: experimental
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 443
      - 8443
    Image|contains:
      - '\AppData\Local\'
      - '\AppData\Roaming\'
      - '\ProgramData\'
      - '\Users\Public\'
  filter_signed:
    Signed: 'true'
  condition: selection and not filter_signed
falsepositives:
  - Portable applications and auto-updaters running from AppData; baseline per-environment
level: medium

// Hunt: browser renderer spawning LOLBins — post-exploitation signature of zero-click browser chains
// Tune the browser list to your managed browser estate. Run over 30 days for retro-hunting.
let browsers = dynamic(["chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe", "iexplore.exe"]);
let lolbins = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "schtasks.exe", "bitsadmin.exe", "wmiprvse.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ (browsers)
| where FileName in~ (lolbins)
| project TimeGenerated, DeviceName, AccountName,
          Browser = InitiatingProcessFileName,
          ChildProcess = FileName,
          ChildCommandLine = ProcessCommandLine,
          InitiatingProcessCommandLine, SHA256, ReportId
| order by TimeGenerated desc;

// Hunt: low-prevalence outbound HTTPS from browsers directly (not via renderer child processes)
// Ad-delivered fingerprinting beacons often hit freshly registered, low-reputation domains.
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (dynamic(["chrome.exe", "msedge.exe", "firefox.exe"]))
| where RemotePort in (443, 8443)
| where isnotempty(RemoteUrl)
| summarize ConnectionCount = count(),
            Devices = dcount(DeviceId),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated)
          by RemoteUrl
| where Devices <= 3   // rare destinations across the fleet — candidate fingerprinting/selection infrastructure
| order by Devices asc, ConnectionCount desc;

-- Velociraptor hunt: browser-spawned child processes across the fleet
-- Deploy as a hunt artifact to identify endpoints that may have executed an ad-delivered exploit chain.
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       getpid_info(pid=Ppid).Name AS ParentName,
       getpid_info(pid=Ppid).Exe AS ParentExe
FROM pslist()
WHERE ParentExe =~ '(?i)(chrome|msedge|firefox|brave|opera|iexplore)\\.exe$'
  AND Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|schtasks|bitsadmin)'

-- Companion artifact: persistence check — COM TreatAs hijack keys under HKCU
SELECT FullPath, Name, Data.value AS Value, Mtime
FROM glob(globs='HKEY_USERS\\*\\Software\\Classes\\CLSID\\*\\TreatAs',
          accessor='registry')
ORDER BY Mtime DESC

# Security Arsenal - Zero-Click Spyware Exposure Audit (Windows)
# Run elevated. Audits persistence surfaces and confirms exploit-hardening telemetry is enabled.

# 1. Verify process creation auditing with command line capture (required for the Sigma/KQL rules above)
$audit = auditpol /get /subcategory:"Process Creation" 2>$null
Write-Host "[i] Process Creation auditing: $audit"
$cmdline = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name 'ProcessCreationIncludeCmdLine_Enabled' -ErrorAction SilentlyContinue
if ($cmdline.ProcessCreationIncludeCmdLine_Enabled -ne 1) {
    Write-Host '[!] Command-line capture NOT enabled - enabling now'
    Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name 'ProcessCreationIncludeCmdLine_Enabled' -Value 1
}

# 2. Hunt for COM hijack persistence (DevilsTongue technique) under user hives
Write-Host '[i] Scanning HKCU CLSID TreatAs keys for COM hijacking...'
Get-ChildItem 'Registry::HKEY_USERS' -ErrorAction SilentlyContinue | ForEach-Object {
    $base = "Registry::$($_.PSChildName)\Software\Classes\CLSID"
    if (Test-Path $base) {
        Get-ChildItem $base -Recurse -ErrorAction SilentlyContinue |
            Where-Object { $_.PSChildName -in 'TreatAs','InprocServer32','LocalServer32' } |
            Select-Object Name, @{N='Values';E={ ($_.GetValueNames() | ForEach-Object { $_.ToString() + '=' + $_.ToString() }) -join '; ' }}
    }
}

# 3. Flag unsigned executables running from user-writable paths (implant staging locations)
Get-Process | Where-Object { $_.Path -match 'AppData|ProgramData|Users\\Public' } | ForEach-Object {
    $sig = Get-AuthenticodeSignature $_.Path -ErrorAction SilentlyContinue
    if ($sig.Status -ne 'Valid') {
        Write-Host "[!] UNSIGNED process from user-writable path: $($_.Name) - $($_.Path)"
    }
}

# 4. Confirm Exploit Protection / ASR telemetry flows to your EDR (Defender example)
$asr = Get-MpPreference -ErrorAction SilentlyContinue
Write-Host "[i] Defender ASR rules configured: $($asr.AttackSurfaceReductionRules_Ids.Count)"

#!/usr/bin/env bash
# Security Arsenal - macOS/iOS-adjacent and Linux exposure checks for zero-click spyware risk
# Zero-click browser/ad chains target mobile and desktop alike. macOS: verify Lockdown Mode posture for at-risk users.

# macOS: check for unexpected configuration profiles (common spyware/C2 management channel)
if command -v profiles >/dev/null 2>&1; then
  echo "[i] Installed configuration profiles (review for unknown entries):"
  profiles show -type configuration 2>/dev/null
fi

# macOS: list LaunchAgents/Daemons with unsigned or user-directory binaries
echo "[i] Persistence items referencing user-writable paths:"
grep -rEl "Library/Application Support|/tmp|/var/tmp" \
  ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons 2>/dev/null

# Linux: outbound beacon triage — long-lived connections on 443 from non-browser processes
echo "[i] Outbound 443 connections from non-standard processes:"
ss -tnp 2>/dev/null | grep ':443 ' | grep -viE 'chrome|firefox|edge|proxy|squid'