FamousSparrow SparroWocky Backdoor: Detection and Hardening Guide for Latin America Operations

---
title: SparroWocky Hunt - Service Creation With Binary In User Writable Path
id: 5f0f0b61-6d2d-4d55-9d1a-9f6d2a77b101
status: experimental
description: Detects creation or modification of Windows services whose binary path points to user-writable or uncommon staging locations. Useful against modular backdoors that persist as services or service-hosted DLLs.
references:
  - https://attack.mitre.org/techniques/T1543/003/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/25
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1543.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\sc.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wmic.exe'
  selection_cli:
    CommandLine|contains:
      - ' create '
      - ' binPath='
      - ' config '
      - ' New-Service'
      - ' Change-Service'
  selection_path:
    CommandLine|contains:
      - '\AppData\Local\'
      - '\AppData\Roaming\'
      - '\ProgramData\'
      - '\Temp\'
      - '\Users\Public\'
      - '\Windows\Temp\'
  condition: selection_img and selection_cli and selection_path
falsepositives:
  - Software deployment tools installing agents under ProgramData
  - Rare developer services registered from build directories
level: high
---
title: SparroWocky Hunt - LOLBin Module Execution From User Writable Paths
id: 9b1d2b58-1d0a-4a5f-a7e7-0f4b8d3a2102
status: experimental
description: Detects rundll32, regsvr32, mshta, or control.exe executing content from user-writable directories, a common way to proxy malicious DLL execution behind signed Microsoft binaries.
references:
  - https://attack.mitre.org/techniques/T1218/
  - https://attack.mitre.org/techniques/T1218/011/
author: Security Arsenal
date: 2026/04/25
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
      - '\control.exe'
  selection_cli:
    CommandLine|contains:
      - '\AppData\Local\'
      - '\AppData\Roaming\'
      - '\ProgramData\'
      - '\Temp\'
      - '\Users\Public\'
      - 'javascript:'
      - '.dll,'
      - 'DllRegisterServer'
  filter_signed_system_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\svchost.exe'
      - '\services.exe'
  condition: selection_img and selection_cli and not filter_signed_system_parent
falsepositives:
  - Enterprise software using AppData for plug-in registration
  - Login scripts that invoke COM registration from ProgramData
level: high
---
title: SparroWocky Hunt - Discovery Burst Followed By Archive Or Network Tooling
id: 2b0d1b0f-0de7-4cb9-a7b2-8b5a4b3c3303
status: experimental
description: Detects a compact discovery burst commonly seen after implant tasking, followed by compression, remote connection, or credential-adjacent tooling in the same session context.
references:
  - https://attack.mitre.org/techniques/T1033/
  - https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/04/25
tags:
  - attack.discovery
  - attack.collection
  - attack.t1033
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_discovery:
    CommandLine|contains:
      - 'whoami /all'
      - 'whoami /priv'
      - 'systeminfo'
      - 'ipconfig /all'
      - 'net group'
      - 'net localgroup'
      - 'nltest /dclist'
      - 'quser'
      - 'query session'
      - 'arp -a'
      - 'route print'
      - 'tasklist /svc'
  selection_follow:
    CommandLine|contains:
      - 'Compress-Archive'
      - '7z.exe'
      - 'rar.exe'
      - 'makecab'
      - 'tar.exe'
      - 'net use'
      - 'mstsc'
      - 'Enter-PSSession'
      - 'psexec'
      - 'winrm'
  condition: selection_discovery and selection_follow
falsepositives:
  - Helpdesk troubleshooting and inventory collection
  - Administrators packaging logs during incidents
level: medium

let lookback = 14d;
let suspicious_paths = dynamic([@"\AppData\Local\", @"\AppData\Roaming\", @"\ProgramData\", @"\Temp\", @"\Users\Public\", @"\Windows\Temp\"]);
let discovery_terms = dynamic(["whoami /all", "whoami /priv", "systeminfo", "ipconfig /all", "net group", "net localgroup", "nltest /dclist", "quser", "query session", "arp -a", "route print", "tasklist /svc"]);
let staging_terms = dynamic(["Compress-Archive", "7z.exe", "rar.exe", "makecab", "tar.exe", "net use", "mstsc", "Enter-PSSession", "psexec", "winrm", "scp.exe", "curl.exe", "bitsadmin"]);
let Proc = DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| project TimeGenerated, DeviceId, DeviceName, AccountName, ProcessId, InitiatingProcessId, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, SHA256, ReportId;
let ServiceLike = Proc
| where FileName in~ ("sc.exe", "powershell.exe", "pwsh.exe", "wmic.exe")
| where ProcessCommandLine has_any (" create ", " binPath=", " config ", "New-Service", "Change-Service")
| where ProcessCommandLine has_any (suspicious_paths);
let LolbinUserPath = Proc
| where FileName in~ ("rundll32.exe", "regsvr32.exe", "mshta.exe", "control.exe")
| where ProcessCommandLine has_any (suspicious_paths)
| where InitiatingProcessFileName !in~ ("explorer.exe", "svchost.exe", "services.exe", "msiexec.exe", "sccmexec.exe");
let DiscoveryBurst = Proc
| where ProcessCommandLine has_any (discovery_terms)
| summarize DiscoveryCount=count(), DiscoveryCmds=make_set(ProcessCommandLine, 20), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceId, AccountName, bin(TimeGenerated, 10m)
| where DiscoveryCount >= 4;
let StagingAfterDiscovery = Proc
| where ProcessCommandLine has_any (staging_terms)
| join kind=inner (DiscoveryBurst) on DeviceId, AccountName
| where TimeGenerated between (FirstSeen .. datetime_add("minute", 60, LastSeen));
ServiceLike
| union LolbinUserPath
| union (StagingAfterDiscovery | project-away DiscoveryCount, DiscoveryCmds, FirstSeen, LastSeen)
| join kind=leftouter (DeviceNetworkEvents
    | where TimeGenerated >= ago(lookback)
    | project NetworkTime=TimeGenerated, DeviceId, InitiatingProcessId, RemoteUrl, RemoteIP, RemotePort, Protocol, InitiatingProcessFileName
    ) on DeviceId, $left.ProcessId == $right.InitiatingProcessId
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, SHA256, RemoteUrl, RemoteIP, RemotePort, ReportId
| order by TimeGenerated desc;

-- Hunt for user-writable executables/modules and their active network connections.
-- Scope: Windows endpoints and servers. Run as a hunt across Latin America business units first.
LET proc <= SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(\\AppData\\Local\\|\\AppData\\Roaming\\|\\ProgramData\\|\\Temp\\|\\Users\\Public\\|\\Windows\\Temp\\)'
   OR CommandLine =~ '(?i)(rundll32|regsvr32|mshta|control\.exe).*(AppData|ProgramData|Temp|Users\\Public)'
   OR CommandLine =~ '(?i)(whoami /all|systeminfo|nltest /dclist|tasklist /svc|Compress-Archive|Enter-PSSession|psexec|winrm)'

LET conns <= SELECT Pid, Name, Status, LocalAddr, LocalPort, RemoteAddr, RemotePort
FROM netstat()
WHERE Status =~ 'ESTABLISHED'

SELECT p.Pid,
       p.Ppid,
       p.Name,
       p.Username,
       p.Exe,
       p.CommandLine,
       p.CreateTime,
       c.RemoteAddr,
       c.RemotePort,
       c.LocalAddr,
       c.LocalPort
FROM proc AS p
LEFT JOIN conns AS c ON p.Pid = c.Pid
ORDER BY p.CreateTime DESC

# SparroWocky-oriented verification and hardening snapshot.
# Run on representative Windows endpoints/servers first. Read-only by default; no deletion is performed.
# Requires: elevated PowerShell. Sysmon, Defender, and process command-line auditing improve value.

$ErrorActionPreference = 'Continue'
$OutRoot = Join-Path $env:ProgramData 'SecurityArsenal\SparroWockyTriage'
New-Item -ItemType Directory -Path $OutRoot -Force | Out-Null
$Stamp = Get-Date -Format 'yyyyMMdd-HHmmss'
$Out = Join-Path $OutRoot "triage-$env:COMPUTERNAME-$Stamp.json"

$WritablePathRegex = '(?i)\\AppData\\Local\\|\\AppData\\Roaming\\|\\ProgramData\\|\\Temp\\|\\Users\\Public\\|\\Windows\\Temp\\'
$DiscoveryRegex = '(?i)(whoami\s+/all|whoami\s+/priv|systeminfo|ipconfig\s+/all|net\s+group|net\s+localgroup|nltest\s+/dclist|quser|query\s+session|arp\s+-a|route\s+print|tasklist\s+/svc)'
$StagingRegex = '(?i)(Compress-Archive|7z\.exe|rar\.exe|makecab|tar\.exe|net\s+use|mstsc|Enter-PSSession|psexec|winrm|scp\.exe|curl\.exe|bitsadmin)'

$result = [ordered]@{
  ComputerName = $env:COMPUTERNAME
  TimestampUtc = (Get-Date).ToUniversalTime().ToString('o')
  Defender = $null
  TamperProtection = $null
  SuspiciousServices = @()
  SuspiciousProcesses = @()
  RecentUserWritableDlls = @()
  EgressListeners = @()
  Recommendations = @()
}

try {
  $mp = Get-MpComputerStatus
  $result.Defender = [ordered]@{
    RealTimeProtectionEnabled = $mp.RealTimeProtectionEnabled
    BehaviorMonitorEnabled = $mp.BehaviorMonitorEnabled
    CloudProtectionEnabled = $mp.IsCloudProtectionEnabled
    TamperProtectionSource = $mp.TamperProtectionSource
    AntivirusSignatureAgeDays = $mp.AntivirusSignatureAge
    QuickScanAgeDays = $mp.QuickScanAge
  }
  $result.TamperProtection = (Get-MpPreference).DisableTamperProtection
} catch {
  $result.Defender = 'Get-MpComputerStatus failed or Defender not present'
}

# Services whose binary or quoted service image points to writable/staging paths.
$result.SuspiciousServices = Get-CimInstance Win32_Service | Where-Object {
  $_.PathName -match $WritablePathRegex -and $_.PathName -notmatch '(?i)\\Windows\\System32\\|\\Program Files\\'
} | Select-Object Name, DisplayName, State, StartMode, StartName, PathName, ProcessId

# Live processes running from staging paths or using LOLBin/discovery/staging command lines.
$result.SuspiciousProcesses = Get-CimInstance Win32_Process | Where-Object {
  ($_.ExecutablePath -match $WritablePathRegex) -or
  ($_.CommandLine -match $WritablePathRegex -and $_.CommandLine -match '(?i)rundll32|regsvr32|mshta|control\.exe') -or
  ($_.CommandLine -match $DiscoveryRegex) -or
  ($_.CommandLine -match $StagingRegex)
} | Select-Object ProcessId, ParentProcessId, Name, ExecutablePath, CommandLine, CreationDate

# Recently created DLL/EXE artifacts in common staging directories.
$paths = @($env:LOCALAPPDATA, $env:APPDATA, $env:ProgramData, $env:TEMP, "$env:PUBLIC", "$env:SystemRoot\Temp") | Where-Object { $_ -and (Test-Path $_) }
$result.RecentUserWritableDlls = foreach ($p in $paths) {
  Get-ChildItem -Path $p -Recurse -Include *.dll,*.exe,*.dat,*.tmp -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
    Select-Object FullName, Length, CreationTime, LastWriteTime
}

# Established outbound connections from processes already matching suspicious criteria.
$procIds = @($result.SuspiciousProcesses | Select-Object -ExpandProperty ProcessId -Unique)
if ($procIds.Count -gt 0) {
  $result.EgressListeners = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $procIds -contains $_.OwningProcess } |
    Select-Object OwningProcess, LocalAddress, LocalPort, RemoteAddress, RemotePort, CreationTime
}

$result.Recommendations += 'Enable process creation command-line auditing and retain Sysmon or equivalent EDR telemetry for at least 30-90 days.'
$result.Recommendations += 'Block or tightly constrain rundll32, regsvr32, mshta, wscript, cscript, msbuild, installutil, and regasm for non-admin users via AppLocker or WDAC.'
$result.Recommendations += 'Require phishing-resistant MFA for remote access, privileged accounts, and third-party vendors; alert on impossible travel and token replay where supported.'
$result.Recommendations += 'Egress-filter servers to approved destinations; deny direct internet for domain controllers, backup infrastructure, and management planes.'
$result.Recommendations += 'Review service creation, scheduled tasks, run keys, WMI subscriptions, and DLL search-order exposure on all privileged systems.'
$result.Recommendations += 'Rotate credentials only after persistence discovery; otherwise attackers may retain tokens or re-enter through remaining implants.'

$result | ConvertTo-Json -Depth 8 | Set-Content -Path $Out -Encoding UTF8
Write-Host "Wrote triage snapshot to $Out"