Defending Against DesckVB RAT: Abusing Google DoubleClick in 2026 Malspam

---
title: Suspicious Redirect from Google DoubleClick to File Download
id: 8c4d9a12-1f73-4b5e-9c6a-2d4e8f901234
status: experimental
description: Detects network traffic where the Referrer is a Google DoubleClick domain, but the destination is a file download or an executable. This indicates potential ad-abuse for malware delivery.
references:
  - https://thehackernews.com/2026/06/google-doubleclick-abused-in-new.html
author: Security Arsenal
date: 2026/06/18
tags:
  - attack.initial_access
  - attack.t1566.002
logsource:
  category: proxy
  product: null
detection:
  selection:
    cs-referrer|contains: 'doubleclick.net'
    cs-method: 'GET'
  filter_legit_content:
    cs-uri-query|contains:
      - 'image'
      - 'css'
      - 'js'
  selection_suspicious_ext:
    cs-uri-extension|contains:
      - 'exe'
      - 'vbs'
      - 'bat'
      - 'cmd'
      - 'scr'
  condition: selection and not filter_legit_content and selection_suspicious_ext
falsepositives:
  - Legitimate software distribution via ad networks (rare for executable types)
level: high
---
title: DesckVB RAT Persistence via Registry Run Key
description: Detects potential DesckVB RAT persistence by monitoring suspicious unsigned executables added to Run keys. VB-based RATs often use simple registry persistence.
references:
  - Internal Threat Research
author: Security Arsenal
date: 2026/06/18
tags:
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - '\Software\Microsoft\Windows\CurrentVersion\Run'
      - '\Software\Microsoft\Windows\CurrentVersion\RunOnce'
  filter_signed:
    Signed: 'true'
  condition: selection and not filter_signed
falsepositives:
  - Legitimate unsigned software updates
level: medium

let DoubleClickDomains = dynamic(['doubleclick.net', 'googleads.g.doubleclick.net']);
let TimeFrame = 1h;
DeviceNetworkEvents
| where Timestamp > ago(TimeFrame)
| where RemoteUrl has_any (DoubleClickDomains)
| project DeviceId, DeviceName, UserId, Timestamp, RemoteUrl, InitiatingProcessFileName
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(TimeFrame)
    | where RemoteUrl !contains "google" // Exclude normal Google traffic immediately after
    | where FileType in ("exe", "vbs", "bat", "dll", "ps1") or RiskScore > 50
    | project DownloadTime=Timestamp, MaliciousUrl=RemoteUrl, DeviceId, UserId
) on DeviceId, UserId
| where DownloadTime between (Timestamp .. (Timestamp + 2m))
| project Timestamp, DeviceName, UserId, ReferrerUrl=RemoteUrl, MaliciousUrl, DownloadTime, InitiatingProcessFileName

-- Hunt for suspicious process execution patterns linked to the campaign
SELECT 
    Pid, 
    Name, 
    CommandLine, 
    Exe, 
    Username, 
    CreateTime
FROM pslist()
WHERE Name IN ('wscript.exe', 'cscript.exe', 'mshta.exe', 'powershell.exe')
  AND CommandLine =~ 'http'
  AND CreateTime > now() - 24h
-- Join with netstat to check for established C2 connections
GROUP BY Pid

# Remediation Script for DoubleClick Abuse Campaign
# Requires Administrator Privileges

Write-Host "[+] Initiating DesckVB RAT Campaign Hardening..." -ForegroundColor Cyan

# 1. Identify and block known malvertising redirectors if specific IPs are found (Placeholder for specific IOCs)
# As a general defense, we ensure traffic to ad-networks is inspected via Proxy.
# If proxy is absent, we add a restrictive hosts entry (Use with caution - breaks ads)
$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
$CheckHosts = Select-String -Path $HostsPath -Pattern "doubleclick.net" -SimpleMatch

if (-not $CheckHosts) {
    Write-Host "[!] Warning: No entry for doubleclick.net in hosts file." -ForegroundColor Yellow
    Write-Host "[?] Recommendation: Ensure corporate proxy inspects SSL traffic to DoubleClick domains." -ForegroundColor Green
} else {
    Write-Host "[+] DoubleClick domains found in hosts file." -ForegroundColor Green
}

# 2. Hunt for DesckVB Indicators (VB-based persistence)
Write-Host "[+] Scanning for suspicious VB-based persistence..." -ForegroundColor Cyan

$RunKeys = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
)

$SuspiciousProcesses = @()
foreach ($Key in $RunKeys) {
    if (Test-Path $Key) {
        Get-ItemProperty $Key | ForEach-Object {
            $Values = $_.PSObject.Properties | Where-Object { $_.Name -ne "PSPath" -and $_.Name -ne "PSParentPath" -and $_.Name -ne "PSChildName" }
            foreach ($Val in $Values) {
                $Path = $Val.Value
                # Check if value points to wscript/cscript or unusual locations
                if ($Path -match "(wscript|cscript|mshta)\.exe" -and $Path -notmatch "C:\Windows\System32") {
                    Write-Host "[!] Suspicious persistence found: $($Val.Name) -> $Path" -ForegroundColor Red
                    $SuspiciousProcesses += $Path
                }
            }
        }
    }
}

if ($SuspiciousProcesses.Count -eq 0) {
    Write-Host "[+] No obvious VB-based persistence mechanisms detected." -ForegroundColor Green
} else {
    Write-Host "[!] Action Required: Investigate and remove registry values listed above." -ForegroundColor Red
}

Write-Host "[+] Remediation script completed." -ForegroundColor Cyan