An independent malware researcher has documented a previously unreported Windows backdoor dubbed SLEEPWALKER — and if you run a SOC, the architecture of this implant should make you uncomfortable. SLEEPWALKER is an unsigned 64-bit Windows DLL, just 59,904 bytes, designed to be side-loaded into a legitimate process. Once resident, it does nothing. It makes no outbound connections, drops no obvious artifacts, and exhibits none of the noisy beaconing behavior most EDR analytics are tuned to catch. It simply waits.
The trigger is a single specifically crafted network packet arriving at the host. When that packet matches the implant's expected pattern, SLEEPWALKER activates and executes operator commands written in a custom 23-instruction bytecode language — an interpreter-in-implant design that keeps plaintext commands and recognizable C2 traffic off the wire and off the disk.
This is the direction mature tradecraft has been heading for years: fileless staging, living inside trusted processes, activation-on-demand rather than persistent beaconing. What makes SLEEPWALKER noteworthy is how compactly it packages all three. There is no CVE here, no vendor patch to chase. This is a detection-engineering and hardening problem, and this post is built to give your team the specific telemetry and controls to solve it.
Technical Analysis
Implant Profile
| Attribute | Detail |
|---|---|
| Type | Windows backdoor / unauthorized access mechanism |
| Format | Unsigned 64-bit DLL, 59,904 bytes |
| Delivery | DLL side-loading into a legitimate host process |
| Activation | Passive — waits for one crafted network packet |
| Execution model | Custom bytecode interpreter (23-instruction language) |
| Attribution | Unknown at time of writing; documented by an independent researcher |
Why This Design Defeats Common Detection Strategies
1. DLL side-loading as the execution vehicle. Side-loading works by placing a malicious DLL where a legitimately signed, trusted executable will load it — exploiting the DLL search order or a known plugin/extension load path. Because the host process is signed and trusted, application control policies and reputation-based EDR verdicts frequently let the load pass. The observable is not the process; it's the module — specifically, an unsigned DLL loaded by a signed Microsoft or third-party binary from an unusual path.
2. Zero-beacon C2. Most network detection assumes periodicity: implants check in, poll for tasking, or exfiltrate. SLEEPWALKER inverts the model — the operator pushes the trigger to the victim. This means:
- Netflow and beacon-analytics (low-and-slow periodic connections) are useless pre-activation.
- The only pre-activation network signal is the listening state: a process holding an open socket or raw packet capture handle that has no business doing so.
3. Custom bytecode execution. A 23-instruction interpreter means the operator's commands never appear as recognizable shell commands, PowerShell, or script content in telemetry until the interpreter acts on them. The defensive implication: you cannot signature the command layer. You must detect the effects — a side-loading host process spawning children, writing files, or making outbound connections after it has been sitting idle, or the module load and socket behavior that precedes everything.
Attack Chain (Defender's View)
- Staging: Malicious DLL (unsigned, ~58.5 KB) is placed on disk — likely via a prior intrusion, loader, or supply-chain vector not described in the reporting.
- Load: A legitimate signed executable loads the DLL (side-load). Process appears trusted.
- Dormancy: Implant registers a network listener or packet filter and waits. No C2, no disk writes, no child processes.
- Trigger: One crafted packet arrives matching the implant's magic pattern.
- Execution: Bytecode interpreter runs operator tasking — the specific instruction set is closed-source to the implant, but effects manifest as standard Windows behaviors (file access, process creation, network egress) from the compromised host process.
Exploitation Status
This is documented researcher analysis of a real sample, not a theoretical technique. There is no CVE, no CISA KEV entry, and no confirmed mass exploitation campaign in the public reporting. Treat this as a capability disclosure: the sample exists, the technique is viable, and the pattern (dormant, packet-triggered, side-loaded implants) is one we should expect to see reused. Detection engineering now — before your incident, not during it — is the correct response.
Detection & Response
The defensible observables, in order of fidelity:
- Unsigned DLLs loaded by signed Microsoft binaries from non-standard paths (the side-load itself).
- Processes holding listening sockets or raw/sniffing handles that are not network services — especially processes that normally make outbound connections but never listen (browsers, Office, third-party updaters).
- Behavioral phase change: a long-idle process suddenly spawning children or making novel outbound connections (the post-trigger signature).
Sigma Rules
---
title: Unsigned DLL Loaded by Signed Microsoft Binary from Unusual Path
id: 3c9e7a41-6b2d-4f58-9a1c-8d4e5f607182
status: experimental
description: Detects potential DLL side-loading consistent with SLEEPWALKER staging — an unsigned module loaded into a signed Microsoft process from a non-system directory.
references:
- https://thehackernews.com/2026/08/newly-sleepwalker-backdoor-waits-for.html
- https://attack.mitre.org/techniques/T1574/002/
author: Security Arsenal
date: 2026/08/14
tags:
- attack.defense_evasion
- attack.persistence
- attack.t1574.002
logsource:
category: image_load
product: windows
detection:
selection_signed_host:
Signed: 'true'
Image|startswith:
- 'C:\Program Files'
- 'C:\Windows'
selection_unsigned_module:
ImageLoaded|startswith:
- 'C:\Users\'
- 'C:\ProgramData\'
- 'C:\Windows\Temp\'
- 'C:\Temp\'
- '\\'
filter_known_paths:
ImageLoaded|startswith:
- 'C:\Users\*\AppData\Local\Microsoft\'
- 'C:\Users\*\AppData\Local\Google\'
- 'C:\Users\*\AppData\Local\Programs\'
condition: selection_signed_host and selection_unsigned_module and not filter_known_paths
falsepositives:
- Legitimate per-user installed applications loading their own plugins
- Developer tooling and portable applications
level: high
---
title: Non-Service Process Holding Unexpected Listening Socket
id: 8f2b6d19-4c7a-4e35-b208-9f1a3c5d7e60
status: experimental
description: Identifies processes with an open listening socket where the binary is not a recognized network service — consistent with a dormant packet-triggered implant such as SLEEPWALKER awaiting its activation packet.
references:
- https://thehackernews.com/2026/08/newly-sleepwalker-backdoor-waits-for.html
- https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/08/14
tags:
- attack.command_and_control
- attack.t1071
logsource:
category: network_connection
product: windows
detection:
selection_listen:
Initiated: 'false'
selection_suspicious_host:
Image|endswith:
- '\svchost.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
- '\mshta.exe'
- '\winword.exe'
- '\excel.exe'
- '\chrome.exe'
- '\msedge.exe'
- '\firefox.exe'
condition: selection_listen and selection_suspicious_host
falsepositives:
- Browsers using WebRTC or local loopback listeners (tune to exclude 127.0.0.1 destinations if needed)
- Legitimate svchost-hosted services (baseline per-host before deployment)
level: medium
---
title: Idle Process Sudden Child Spawn After Network Inbound Event
id: 5d1a9c74-2e8f-4b63-a795-0c4d6e8f2a31
status: experimental
description: Detects post-activation behavior of a dormant implant — a process that received an inbound network connection spawning command interpreters or LOLBins, consistent with SLEEPWALKER bytecode execution effects.
references:
- https://thehackernews.com/2026/08/newly-sleepwalker-backdoor-waits-for.html
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/14
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\svchost.exe'
- '\rundll32.exe'
- '\dllhost.exe'
- '\chrome.exe'
- '\msedge.exe'
- '\winword.exe'
- '\excel.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\wmic.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
- '\rundll32.exe'
condition: selection_parent and selection_child
falsepositives:
- Browser extension or update mechanisms (rare; baseline per environment)
- Office macros — which are themselves high-signal and worth the alert volume
level: high
A note on tuning: the listening-socket rule is the highest-value and highest-maintenance of the three. Baseline your environment for two weeks before raising it above medium. Servers running legitimate agents (backup, monitoring, remote access) will need allowlists — but on user workstations, a listening socket owned by a browser or Office process is almost never legitimate.
KQL Hunt — Microsoft Sentinel / Defender
// Hunt 1: Unsigned module loads into signed processes from user-writable paths (side-load staging)
DeviceImageLoadEvents
| where TimeGenerated > ago(14d)
| where FolderPath startswith @"C:\Users\" or FolderPath startswith @"C:\ProgramData\" or FolderPath startswith @"C:\Windows\Temp\"
| where InitiatingProcessFolderPath startswith @"C:\Program Files" or InitiatingProcessFolderPath startswith @"C:\Windows\System32"
| join kind=leftouter (
DeviceFileCertificateInfo
| where TimeGenerated > ago(14d)
| project SHA1, IsSigned=IsTrusted, Signer
) on SHA1
| where IsSigned != true
| summarize LoadCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated),
Hosts=dcount(DeviceName), HostList=make_set(DeviceName, 10)
by FileName, FolderPath, InitiatingProcessFileName, SHA1
| where Hosts <= 3 // low-prevalence loads are the interesting ones
| order by FirstSeen desc;
// Hunt 2: Unexpected listening endpoints owned by non-service processes (dormant trigger socket)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where ActionType == "ListeningConnectionCreated" or (InitiatingProcessFileName in~ (
"svchost.exe","rundll32.exe","dllhost.exe","chrome.exe","msedge.exe","firefox.exe",
"winword.exe","excel.exe","outlook.exe","mshta.exe","regsvr32.exe"))
| where RemoteIPType == "Public" or LocalPort !in (135, 139, 445, 3389, 5357)
| summarize Connections=count(), Ports=make_set(LocalPort, 10), FirstSeen=min(TimeGenerated)
by InitiatingProcessFileName, InitiatingProcessFolderPath, DeviceName
| order by FirstSeen desc;
// Hunt 3: Post-activation phase change — LOLBin child of a long-lived network-capable process
let SuspiciousParents = dynamic(["svchost.exe","rundll32.exe","dllhost.exe","chrome.exe","msedge.exe","winword.exe","excel.exe"]);
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","wmic.exe","certutil.exe","bitsadmin.exe","regsvr32.exe","mshta.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (SuspiciousParents)
| where FileName in~ (SuspiciousChildren)
| join kind=leftsemi (
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where ActionType == "ConnectionSuccess" or ActionType == "InboundConnectionAccepted"
| project InitiatingProcessId, DeviceName
) on $left.InitiatingProcessId == $right.InitiatingProcessId and $left.DeviceName == $right.DeviceName
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
FileName, ProcessCommandLine, AccountName, SHA256
| order by TimeGenerated desc;
Hunt 1 is your primary side-load detector; the Hosts <= 3 prevalence filter is doing the heavy lifting — signed software loads its unsigned plugins fleet-wide, but an implant lands on a handful of machines. If you ingest Sysmon or EDR data into Sentinel via SecurityEvent/CommonSecurityLog instead of MDE, port the same logic to Event ID 7 (image load) and Event ID 3 (network connection).
Velociraptor VQL
-- SLEEPWALKER-style hunt: unsigned DLLs loaded by running processes + unexpected listeners
-- Part 1: Enumerate processes and flag unsigned/odd-path modules via pslist
SELECT Pid, Name, Exe, Username, CommandLine, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)Users\\|ProgramData\\|Temp\\'
AND Name !~ '(?i)(teams|spotify|slack|discord|zoom|onedrive|dropbox|brave)'
-- Part 2: Correlate listening sockets with owning processes (run as a second artifact or join)
SELECT Pid, Name, Exe, Username
FROM pslist()
WHERE Pid IN (
SELECT Pid FROM netstat()
WHERE Status =~ 'LISTEN'
AND Laddr.IP !~ '^(127\.|0\.0\.0\.0$|\[::1\])' = False -- keep all, review loopback separately
)
AND Name =~ '(?i)(rundll32|dllhost|svchost|chrome|msedge|winword|excel|mshta|regsvr32)'
-- Part 3: Locate candidate implant DLLs on disk by size and location (SLEEPWALKER sample: 59,904 bytes)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
'C:/Users/**/*.dll',
'C:/ProgramData/**/*.dll',
'C:/Windows/Temp/**/*.dll'
])
WHERE Size BETWEEN 50000 AND 80000
AND Mtime > '2026-01-01'
ORDER BY Mtime DESC
The size-band glob in Part 3 is deliberately scoped to the reported sample footprint (~59.9 KB) plus slack for recompilation. It will miss recompiled variants outside the band — use it as a triage accelerator, not a boundary. The listener correlation in Part 2 is the durable detection: it survives recompilation entirely.
Remediation & Verification Script
# SLEEPWALKER-style implant triage and hardening script
# Run elevated. Read-only by default; -Remediate enables quarantine actions.
param([switch]$Remediate)
$report = @()
$outDir = "$env:ProgramData\SecArsenal\SleepwalkerTriage_$(Get-Date -Format yyyyMMdd_HHmmss)"
New-Item -ItemType Directory -Path $outDir -Force | Out-Null
# --- 1. Unsigned DLLs loaded from user-writable paths ---
Write-Host "[*] Checking loaded modules from non-standard paths..." -ForegroundColor Cyan
$susPaths = @("$env:SystemDrive\Users", "$env:SystemDrive\ProgramData", "$env:WINDIR\Temp")
foreach ($proc in Get-Process) {
try {
foreach ($mod in $proc.Modules) {
if ($susPaths | Where-Object { $mod.FileName -like "$_*" }) {
$sig = Get-AuthenticodeSignature -FilePath $mod.FileName -ErrorAction SilentlyContinue
if ($sig.Status -ne 'Valid') {
$report += [PSCustomObject]@{
Type='UnsignedModule'; Process=$proc.ProcessName; PID=$proc.Id
Path=$mod.FileName; Size=(Get-Item $mod.FileName).Length
SigStatus=$sig.Status
}
}
}
}
} catch {}
}
# --- 2. Unexpected listening processes ---
Write-Host "[*] Enumerating listening sockets by owning process..." -ForegroundColor Cyan
$listeners = Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue
foreach ($l in $listeners) {
$p = Get-Process -Id $l.OwningProcess -ErrorAction SilentlyContinue
if ($p -and $p.ProcessName -match '^(rundll32|dllhost|chrome|msedge|firefox|winword|excel|outlook|mshta|regsvr32)$') {
$report += [PSCustomObject]@{
Type='SuspiciousListener'; Process=$p.ProcessName; PID=$p.Id
Path=$p.Path; Size=''; SigStatus="Port $($l.LocalPort) on $($l.LocalAddress)"
}
}
}
# --- 3. Candidate implant DLLs on disk (size-band hunt around 59,904-byte sample) ---
Write-Host "[*] Scanning for DLLs matching the reported sample size band..." -ForegroundColor Cyan
foreach ($root in $susPaths) {
Get-ChildItem -Path $root -Recurse -Filter *.dll -ErrorAction SilentlyContinue |
Where-Object { $_.Length -ge 50000 -and $_.Length -le 80000 -and $_.LastWriteTime -gt '2026-01-01' } |
ForEach-Object {
$sig = Get-AuthenticodeSignature -FilePath $_.FullName
if ($sig.Status -ne 'Valid') {
$report += [PSCustomObject]@{
Type='SizeBandDLL'; Process=''; PID=''
Path=$_.FullName; Size=$_.Length; SigStatus=$sig.Status
}
}
}
}
# --- 4. Hardening: enable DLL search-order mitigation and Script Block / module load auditing ---
Write-Host "[*] Verifying hardening controls..." -ForegroundColor Cyan
$cwSafe = Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager' -Name CWDIllegalInDllSearch -ErrorAction SilentlyContinue
if (-not $cwSafe -or $cwSafe.CWDIllegalInDllSearch -lt 2) {
Write-Host "[!] CWDIllegalInDllSearch not set to 2 (CWD removed from DLL search order)." -ForegroundColor Yellow
if ($Remediate) {
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager' -Name CWDIllegalInDllSearch -Value 2 -Type DWord
Write-Host "[+] Set CWDIllegalInDllSearch = 2 (reboot required)." -ForegroundColor Green
}
}
# Verify Sysmon presence (image-load telemetry is the backbone of this detection)
if (-not (Get-Service -Name Sysmon* -ErrorAction SilentlyContinue)) {
Write-Host "[!] No Sysmon service detected. Deploy Sysmon with image-load (ID 7) and network (ID 3) logging." -ForegroundColor Yellow
}
# --- 5. Optional quarantine ---
if ($Remediate -and ($report | Where-Object Type -eq 'SizeBandDLL')) {
$report | Where-Object Type -eq 'SizeBandDLL' | ForEach-Object {
$dest = Join-Path $outDir ((Split-Path $_.Path -Leaf) + '.quarantine')
Move-Item -Path $_.Path -Destination $dest -Force
Write-Host "[+] Quarantined $($_.Path) -> $dest" -ForegroundColor Green
}
}
$report | Export-Csv -Path (Join-Path $outDir 'findings.csv') -NoTypeInformation
Write-Host "[*] Triage complete. $($report.Count) findings -> $outDir\findings.csv" -ForegroundColor Cyan
$report | Format-Table -AutoSize
Run this in read-only mode first across a pilot OU via your RMM or Intune. The quarantine path is intentionally gated behind -Remediate — unsigned DLLs in user paths include legitimate software (Electron apps, Python distributions, game launchers), and a blind move will break applications.
Remediation
There is no patch because there is no vulnerability — SLEEPWALKER abuses Windows working as designed (DLL loading, sockets, memory execution). Remediation is therefore structural, and it falls into three buckets:
1. Kill the side-load vector.
- Deploy WDAC or AppLocker policies that enforce DLL signing requirements for high-value processes. Start in audit mode; Microsoft-documented side-load targets (search Microsoft's public side-load advisories and the LOLBins project for known-abused binaries) are your priority list.
- Set
CWDIllegalInDllSearch = 2(covered in the script above) to remove the current working directory from the DLL search order. - Restrict write access to directories adjacent to side-load-prone signed binaries, and alert on any new DLL appearing next to a signed executable in
Program Files— legitimate installers do this at install time, implants do it at 3 AM.
2. Own the telemetry.
- Sysmon (or equivalent EDR) with Event ID 7 (ImageLoad) and Event ID 3 (NetworkConnect) is non-negotiable for this threat class. If you cannot see module loads, you cannot see side-loading. Full stop.
- Forward listening-socket state to your SIEM on a schedule — MDE's
ListeningConnectionCreatedor a periodicnetstatcollection — so the dormant phase is visible, not just the activated phase. - Alert on process age vs. behavior deltas: any process running longer than 24 hours that suddenly spawns its first child process or first outbound connection deserves a second look. This is the post-trigger signature and it generalizes across this entire malware family.
3. Network-side controls for a packet-triggered implant.
- Default-deny inbound on workstation VLANs. A packet-triggered implant that cannot receive its trigger packet is a dead implant. There is almost no legitimate reason for arbitrary inbound connections to user endpoints.
- Egress filtering with TLS inspection where feasible — the post-activation phase must eventually talk to something, and deny-by-default egress converts an invisible implant into a blocked connection alert.
- IDS/IPS rules keyed on single-packet triggers are generally impractical without knowing the magic packet format; invest in the endpoint telemetry above instead.
Incident response note: if you find a host with an unexplained listening socket or a size-band DLL hit, do not kill the process first. Capture memory (Velociraptor's Windows.Memory.Acquisition or a manual dump) before remediation — the 23-instruction interpreter and any operator tasking exist only in memory, and pulling the plug destroys the most valuable forensic evidence in the investigation. Treat it as a full IR engagement: because the implant is dormant until triggered, its presence implies a prior, separate staging intrusion you haven't found yet.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.