SectopRAT via Fake Claude Desktop Installers: Bing Malvertising, EtherHiding C2 & DLL Sideloading — OTX Detection Pack

---
title: SectopRAT FakeAgent - DLL Sideloading via Java Chromium Embedded Framework
id: 5c1f2a9e-7d3b-4f01-9a2c-sectoprat001
status: experimental
description: Detects DLL sideloading patterns consistent with the FakeAgent campaign delivering SectopRAT via trojanized Claude Desktop installers. A signed JCEF/Chromium Embedded Framework binary loads an unsigned or unexpected DLL from a user-writable or non-standard directory.
author: Security Arsenal Threat Intel
logsource:
    category: image_load
    product: windows
    definition: Sysmon required for image_load telemetry
detection:
    selection_parent:
        ParentImage|endswith:
            - '\jcef_helper.exe'
            - '\java.exe'
            - '\javaw.exe'
        ParentImage|contains:
            - 'claude'
            - 'jcef'
            - 'cef'
    selection_dll_path:
        ImageLoaded|contains:
            - '\AppData\Local\Temp\'
            - '\Users\Public\'
            - '\Downloads\'
            - '\AppData\Roaming\'
    filter_signed:
        Signed: 'true'
    condition: selection_parent and selection_dll_path and not filter_signed
falsepositives:
    - Legitimate JCEF applications loading plugins from AppData (verify signer and installer provenance)
level: high
tags:
    - attack.defense_evasion
    - attack.t1574.002
    - attack.execution
---
title: SectopRAT FakeAgent - Masqueraded Scheduled Task Persistence
id: 5c1f2a9e-7d3b-4f02-9a2c-sectoprat002
status: experimental
description: Detects scheduled task creation pointing to executables or DLLs in user-writable directories, matching the FakeAgent/SectopRAT persistence mechanism that triggered the original intrusion hunt. Task names frequently masquerade as browser or software updaters.
author: Security Arsenal Threat Intel
logsource:
    product: windows
    service: security
    definition: Event ID 4698 requires Audit Scheduled Task Creation policy
detection:
    selection_event:
        EventID: 4698
    selection_task_path:
        TaskContent|contains:
            - 'AppData\Local\Temp'
            - 'AppData\Roaming'
            - 'Users\Public'
            - 'Downloads'
            - 'rundll32'
            - 'regsvr32'
    selection_task_name:
        TaskName|contains:
            - 'Update'
            - 'Updater'
            - 'Maintenance'
            - 'Claude'
            - 'Sync'
    condition: selection_event and selection_task_path and selection_task_name
falsepositives:
    - Legitimate software updaters in AppData (validate binary signer against expected vendor)
level: high
tags:
    - attack.persistence
    - attack.t1053.005
    - attack.defense_evasion
    - attack.t1036
---
title: SectopRAT EtherHiding - Blockchain RPC Query from Non-Wallet Process
id: 5c1f2a9e-7d3b-4f03-9a2c-sectoprat003
status: experimental
description: Detects outbound connections to public blockchain RPC endpoints from processes with no legitimate reason to interact with smart contracts. EtherHiding retrieves SectopRAT C2 configuration from on-chain storage.
author: Security Arsenal Threat Intel
logsource:
    category: network_connection
    product: windows
detection:
    selection_rpc_host:
        DestinationHostname|contains:
            - 'bsc-dataseed'
            - 'binance.org'
            - 'eth-mainnet'
            - 'mainnet.infura.io'
            - 'rpc.ankr.com'
            - 'cloudflare-eth.com'
            - 'polygon-rpc.com'
    filter_expected:
        Image|endswith:
            - '\metamask.exe'
            - '\electrum.exe'
            - '\exodus.exe'
    condition: selection_rpc_host and not filter_expected
falsepositives:
    - Web3 developer tooling and dApp testing (scope exclusions to developer OUs if needed)
level: medium
tags:
    - attack.command_and_control
    - attack.t1102
    - attack.t1071.001
date: 2026/09/24

// SectopRAT FakeAgent hunt - trojanized Claude Desktop installer execution,
// IOC network communication, and scheduled task persistence (Microsoft Sentinel)
let iocDomain = "neeitoerw.my";
let lookback = 30d;
let NetworkHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemoteUrl contains iocDomain or RemoteUrl contains "bsc-dataseed" or RemoteUrl contains "mainnet.infura.io"
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType;
let ClaudeFakeInstaller =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where (FileName has_any ("claude", "ClaudeDesktop", "setup") or ProcessCommandLine has "claude")
    | where FolderPath has_any ("\Downloads\", "\Temp\", "\Users\Public\")
    | project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, SHA256, InitiatingProcessFileName;
let SuspiciousTasks =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName =~ "schtasks.exe" and ProcessCommandLine has "/create"
    | where ProcessCommandLine has_any ("AppData", "Users\Public", "Temp", "rundll32")
    | project TimeGenerated, DeviceName, ProcessCommandLine, AccountName, InitiatingProcessFileName;
union NetworkHits, ClaudeFakeInstaller, SuspiciousTasks
| order by TimeGenerated desc

# SectopRAT FakeAgent IOC & artifact hunt - run elevated on suspect endpoints
# Checks: IOC connections, masqueraded scheduled tasks, sideload staging paths, fake Claude installers

$iocDomain = "neeitoerw.my"
$report = @()

Write-Host "[1] Checking DNS cache and active connections for IOC: $iocDomain" -ForegroundColor Cyan
$dnsHits = Get-DnsClientCache | Where-Object { $_.Entry -like "*$iocDomain*" }
$netHits = Get-NetTCPConnection -ErrorAction SilentlyContinue | ForEach-Object {
    try {
        $resolved = (Resolve-DnsName -Name $_.RemoteAddress -ErrorAction SilentlyContinue).NameHost
    } catch { $resolved = $null }
    if ($resolved -like "*$iocDomain*") { $_ }
}
if ($dnsHits)  { $report += "DNS CACHE HIT: $($dnsHits.Entry -join ', ')" }
if ($netHits)  { $report += "ACTIVE CONNECTION HIT to $iocDomain (PID $($netHits.OwningProcess -join ','))" }

Write-Host "[2] Hunting masqueraded scheduled tasks pointing to user-writable paths" -ForegroundColor Cyan
$susPaths = 'AppData','Users\Public','Temp','Downloads','rundll32','regsvr32'
Get-ScheduledTask | ForEach-Object {
    foreach ($action in $_.Actions) {
        $cmdLine = "$($action.Execute) $($action.Arguments)"
        foreach ($p in $susPaths) {
            if ($cmdLine -match $p) {
                $report += "SUSPICIOUS TASK: $($_.TaskName) | $($_.TaskPath) | $cmdLine"
            }
        }
    }
}

Write-Host "[3] Searching for fake Claude Desktop installer artifacts" -ForegroundColor Cyan
$claudeArtifacts = Get-ChildItem -Path "$env:USERPROFILE\Downloads","$env:TEMP","C:\Users\Public" -Recurse -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match 'claude|ClaudeDesktop' -and $_.Extension -match '\.(exe|msi|dll)$' } |
    Select-Object FullName, Length, CreationTime
if ($claudeArtifacts) {
    foreach ($a in $claudeArtifacts) {
        $sig = Get-AuthenticodeSignature -FilePath $a.FullName -ErrorAction SilentlyContinue
        $report += "CLAUDE ARTIFACT: $($a.FullName) | Created $($a.CreationTime) | SigStatus: $($sig.Status) | Signer: $($sig.SignerCertificate.Subject)"
    }
}

Write-Host "[4] Checking for unsigned DLLs staged beside JCEF/Chromium Embedded binaries" -ForegroundColor Cyan
Get-ChildItem -Path "$env:LOCALAPPDATA","$env:APPDATA" -Recurse -Include "*.dll" -ErrorAction SilentlyContinue |
    Where-Object { $_.DirectoryName -match 'jcef|cef|claude' } | ForEach-Object {
        $sig = Get-AuthenticodeSignature -FilePath $_.FullName -ErrorAction SilentlyContinue
        if ($sig.Status -ne 'Valid') { $report += "UNSIGNED DLL: $($_.FullName) | Status: $($sig.Status)" }
    }

Write-Host "`n===== HUNT RESULTS =====" -ForegroundColor Yellow
if ($report.Count -eq 0) { Write-Host "No artifacts found." -ForegroundColor Green }
else { $report | ForEach-Object { Write-Host $_ -ForegroundColor Red } }