Operation Endgame Takedown: Detecting and Remediating Gootloader, CastleRAT, and StealC After the Seizure of 6.4M Stolen Logins

---
title: Gootloader JavaScript Execution via Windows Script Host from User Directories
id: 3f9c2a71-8b4d-4e6a-9c15-7d2e5f8a1b03
status: experimental
description: Detects wscript.exe or cscript.exe executing JavaScript files from Downloads, Temp, or AppData paths, consistent with Gootloader's fake-forum ZIP delivery mechanism.
references:
  - https://thehackernews.com/2026/11/operation-endgame-takes-down-gootloader.html
  - https://attack.mitre.org/techniques/T1059/007/
author: Security Arsenal
date: 2026/11/14
tags:
  - attack.execution
  - attack.t1059.007
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_host:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
  selection_path:
    CommandLine|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Temp\'
  selection_ext:
    CommandLine|contains:
      - '.js'
      - '.jse'
  condition: selection_host and selection_path and selection_ext
falsepositives:
  - Rare; legitimate user-context script execution from these paths is uncommon in managed environments
level: high
---
title: Script-Based Scheduled Task Persistence in User-Writable Path
id: 8e1b4d62-3c7a-4f59-b208-9a6c1e4d7f52
status: experimental
description: Detects creation of scheduled tasks whose action executes script files (.js, .jse, .vbs) from user-writable directories, a documented Gootloader persistence mechanism.
references:
  - https://thehackernews.com/2026/11/operation-endgame-takes-down-gootloader.html
  - https://attack.mitre.org/techniques/T1053/005/
author: Security Arsenal
date: 2026/11/14
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1053.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_schtasks:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains: '/create'
  selection_wsh_task:
    CommandLine|contains:
      - 'wscript.exe'
      - 'cscript.exe'
  selection_script_path:
    CommandLine|contains:
      - '\AppData\'
      - '\Users\Public\'
      - '\ProgramData\'
  condition: selection_schtasks and (selection_wsh_task or selection_script_path)
falsepositives:
  - Software updaters occasionally register tasks from ProgramData; validate the task action and signer
level: high
---
title: Non-Browser Process Accessing Browser Credential Stores
id: b47d2f90-6e1c-4a83-9d54-2c8f6a1e9b37
status: experimental
description: Detects processes other than the browser itself opening browser credential or cookie database files, a high-fidelity indicator of infostealer activity such as StealC.
references:
  - https://thehackernews.com/2026/11/operation-endgame-takes-down-gootloader.html
  - https://attack.mitre.org/techniques/T1555/003/
author: Security Arsenal
date: 2026/11/14
tags:
  - attack.credential_access
  - attack.t1555.003
logsource:
  category: file_event
  product: windows
detection:
  selection_files:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\'
      - '\Microsoft\Edge\User Data\'
      - '\BraveSoftware\Brave-Browser\User Data\'
      - '\Mozilla\Firefox\Profiles\'
  selection_targets:
    TargetFilename|endswith:
      - '\Login Data'
      - '\Cookies'
      - '\Web Data'
      - '\Local State'
      - '\logins.json'
      - '\key4.db'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\firefox.exe'
  filter_backup:
    Image|endswith:
      - '\MsMpEng.exe'
  condition: selection_files and selection_targets and not filter_browsers and not filter_backup
falsepositives:
  - Enterprise backup and DLP agents; EDR tooling itself; whitelist by signer and process path after validation
level: critical

let lookback = 30d;
let scriptHosts = dynamic(["wscript.exe", "cscript.exe"]);
let suspiciousPaths = dynamic(["\\Downloads\\", "\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\", "\\Temp\\"]);
// Part 1: Gootloader-style JS execution from user directories
let GootloaderExec = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName has_any (scriptHosts)
| where ProcessCommandLine has_any (suspiciousPaths)
| where ProcessCommandLine has_any (".js", ".jse")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256
| extend Detection = "Gootloader JS execution";
// Part 2: Script host spawning follow-on tooling (payload staging)
let ScriptHostChildren = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where InitiatingProcessFileName has_any (scriptHosts)
| where FileName in~ ("powershell.exe", "rundll32.exe", "regsvr32.exe", "cmd.exe", "mshta.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256
| extend Detection = "Script host child process";
// Part 3: StealC-style access to browser credential stores by non-browser processes
let StealerAccess = DeviceFileEvents
| where Timestamp > ago(lookback)
| where FileName in~ ("Login Data", "Cookies", "Web Data", "Local State", "logins.json", "key4.db")
| where FolderPath has_any ("Chrome\\User Data", "Edge\\User Data", "Brave-Browser", "Firefox\\Profiles")
| where not(InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "brave.exe", "firefox.exe", "msmpeng.exe"))
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, InitiatingProcessSHA256
| extend Detection = "Browser credential store access";
union GootloaderExec, ScriptHostChildren, StealerAccess
| sort by Timestamp desc

DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName =~ "schtasks.exe"
| where ProcessCommandLine has "/create"
| where ProcessCommandLine has_any ("wscript", "cscript", "\\AppData\\", "\\Users\\Public\\")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

-- Operation Endgame post-takedown sweep: Gootloader staging, script persistence, live script hosts
-- Artifact 1: Recently created JavaScript files in user Downloads directories
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs='C:/Users/*/Downloads/**/*.js')
WHERE Mtime > now() - 2592000

-- Artifact 2: Running Windows Script Host processes and their command lines
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)wscript|cscript'
   OR CommandLine =~ '(?i)\.js|\.jse|\.vbs'

-- Artifact 3: Scheduled tasks whose actions reference script interpreters or user paths
SELECT Name, CommandLine, Exe, Username
FROM pslist()
WHERE CommandLine =~ '(?i)schtasks.*(/create|/change)'
   AND CommandLine =~ '(?i)wscript|cscript|appdata|users\\public'

-- Enumerate browser credential stores and timestamps for stealer scoping
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
  'C:/Users/*/AppData/Local/Google/Chrome/User Data/*/Login Data',
  'C:/Users/*/AppData/Local/Microsoft/Edge/User Data/*/Login Data',
  'C:/Users/*/AppData/Roaming/Mozilla/Firefox/Profiles/*/logins.json'
])

# Operation Endgame post-takedown endpoint triage
# Run elevated. Outputs findings to C:\IR-Triage\triage-<hostname>-<date>.txt

$outDir = "C:\IR-Triage"
New-Item -Path $outDir -ItemType Directory -Force | Out-Null
$log = Join-Path $outDir ("triage-" + $env:COMPUTERNAME + "-" + (Get-Date -Format 'yyyyMMdd-HHmm') + ".txt")

function Write-Find($msg) { $msg | Tee-Object -FilePath $log -Append }

Write-Find "=== Gootloader / StealC / CastleRAT triage: $env:COMPUTERNAME ===`n"

# 1. Scheduled tasks executing scripts or running from user-writable paths
Write-Find "--- [1] Suspicious scheduled tasks ---"
$susTasks = Get-ScheduledTask | ForEach-Object {
    $actions = $_.Actions | Where-Object {
        $_.Execute -match 'wscript|cscript|powershell' -or
        $_.Execute -match 'AppData|Users\\Public|ProgramData' -or
        $_.Arguments -match '\.js|\.jse|\.vbs'
    }
    if ($actions) {
        [PSCustomObject]@{
            TaskName = $_.TaskName; TaskPath = $_.TaskPath
            State = $_.State
            Execute = ($actions.Execute -join '; ')
            Arguments = ($actions.Arguments -join '; ')
        }
    }
}
if ($susTasks) {
    $susTasks | Format-List | Out-String | ForEach-Object { Write-Find $_ }
    # Disable (do NOT delete yet - preserve for forensics)
    foreach ($t in $susTasks) {
        Disable-ScheduledTask -TaskName $t.TaskName -TaskPath $t.TaskPath -ErrorAction SilentlyContinue
        Write-Find "DISABLED: $($t.TaskPath)$($t.TaskName)"
    }
} else { Write-Find "No suspicious scheduled tasks found.`n" }

# 2. JavaScript files staged in user Downloads/AppData (Gootloader staging)
Write-Find "`n--- [2] Recently modified .js files in user profile paths ---"
$cutoff = (Get-Date).AddDays(-45)
$jsFiles = Get-ChildItem -Path "C:\Users" -Recurse -Include *.js,*.jse -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt $cutoff -and $_.FullName -match 'Downloads|AppData' } |
    Select-Object FullName, LastWriteTime, Length
if ($jsFiles) { $jsFiles | Format-Table -AutoSize | Out-String | ForEach-Object { Write-Find $_ } }
else { Write-Find "No recent staged scripts found.`n" }

# 3. Running script-host processes
Write-Find "`n--- [3] Active script-host processes ---"
$wsh = Get-CimInstance Win32_Process -Filter "Name='wscript.exe' OR Name='cscript.exe'" |
    Select-Object ProcessId, Name, CommandLine
if ($wsh) { $wsh | Format-List | Out-String | ForEach-Object { Write-Find $_ } }
else { Write-Find "No active script hosts.`n" }

# 4. Run-key persistence referencing scripts or user paths
Write-Find "`n--- [4] Suspicious Run keys ---"
$runKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key | Get-Member -MemberType NoteProperty | ForEach-Object {
            $val = (Get-ItemProperty $key).($_.Name)
            if ($val -match 'wscript|cscript|\.js|\.vbs|AppData|Temp') {
                Write-Find "$key :: $($_.Name) = $val"
            }
        }
    }
}

# 5. Verify JS file association hardening status (defense-in-depth)
Write-Find "`n--- [5] .js file association check (should be txtfile/notepad, NOT WScript) ---"
$jsAssoc = (Get-ItemProperty 'HKLM:\SOFTWARE\Classes\.js' -ErrorAction SilentlyContinue).'(default)'
Write-Find ".js default class: $jsAssoc"

Write-Find "`n=== Triage complete. Preserve $log and any staged scripts for forensics before reimaging. ==="