SparroWocky Backdoor & GhostEmperor (FamousSparrow) LATAM Government Espionage Campaign: OTX Pulse Detection Pack

---
title: SparroWocky Backdoor Registry Run Key Persistence
description: Detects persistence via registry Run keys with characteristics consistent with FamousSparrow/GhostEmperor SparroWocky and SparrowDoor implants — suspicious value names, non-standard binary paths, or masquerading update tasks.
id: 7a1f2c31-9b3e-4d6a-8f21-sparrowock0001
status: experimental
author: Security Arsenal Threat Intel
date: 2026/10/17
references:
  - https://www.welivesecurity.com/en/eset-research/beware-sparrowock-backdoor-bites-commands-catch/
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\Software\Microsoft\Windows\CurrentVersion\Run'
      - '\Software\Microsoft\Windows\CurrentVersion\RunOnce'
  selection_suspicious_path:
    Details|contains:
      - '\ProgramData\'
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
      - '\Windows\Temp\'
  filter_legit_vendors:
    Details|contains:
      - 'C:\Program Files\'
      - 'C:\Program Files (x86)\'
  condition: selection_key and selection_suspicious_path and not filter_legit_vendors
falsepositives:
  - Legitimate portable or IT-deployed software registering autorun entries
level: high
tags:
  - attack.persistence
  - attack.t1547.001
---
title: SparroWocky Suspicious DLL Side-Loading via Signed System Binary
description: Detects rundll32/regsvr32 execution of DLLs from user-writable or temp directories, matching GhostEmperor staging tradecraft for SparroWocky deployment on compromised government hosts.
id: 7a1f2c31-9b3e-4d6a-8f21-sparrowock0002
status: experimental
author: Security Arsenal Threat Intel
date: 2026/10/17
references:
  - https://www.welivesecurity.com/en/eset-research/beware-sparrowock-backdoor-bites-commands-catch/
logsource:
  category: process_creation
  product: windows
detection:
  selection_loader:
    Image|endswith:
      - '\rundll32.exe'
      - '\regsvr32.exe'
  selection_dll_path:
    CommandLine|contains:
      - '\AppData\'
      - '\ProgramData\'
      - '\Temp\'
      - '\Users\Public\'
  filter_system_dirs:
    CommandLine|contains:
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
  condition: selection_loader and selection_dll_path and not filter_system_dirs
falsepositives:
  - Software installers executing setup DLLs from temp paths
level: high
tags:
  - attack.defense-evasion
  - attack.t1218
  - attack.t1574.002
---
title: SparroWocky Backdoor Beaconing - Periodic Outbound Web Traffic from Non-Browser Process
description: Detects HTTP/HTTPS network connections from non-browser, non-update processes characteristic of SparroWocky C2 tasking channels disguised as ordinary web traffic.
id: 7a1f2c31-9b3e-4d6a-8f21-sparrowock0003
status: experimental
author: Security Arsenal Threat Intel
date: 2026/10/17
references:
  - https://www.welivesecurity.com/en/eset-research/beware-sparrowock-backdoor-bites-commands-catch/
logsource:
  category: network_connection
  product: windows
detection:
  selection_port:
    DestinationPort:
      - 80
      - 443
      - 8080
  selection_process:
    Image|endswith:
      - '\dllhost.exe'
      - '\svchost.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  filter_private:
    DestinationIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection_port and selection_process and not filter_private
falsepositives:
  - Windows Update and legitimate svchost-originated traffic; baseline per-host before alerting
level: medium
tags:
  - attack.command-and-control
  - attack.t1071.001

// SparroWocky / FamousSparrow hunt — hash match + behavioral pivots
// 1) Direct hash matches across file events
let SparroWockyHashes = dynamic([
  "23e228d5603b4802398b2e7419187aef71ff9dd5",
  "2560b7e28b322bb7a56d0b1da1b2652e1efe76ea",
  "4df896624695ea2780552e9ea3c40661dc84efc8",
  "76c430b55f180a85f4e1a1e40e4a2ea37db97599",
  "873f98caf234c3a8a9db18343dad7b42117e85d4",
  "b9601e60f87545441bf8579b2f62668c56507f4a",
  "bb2f5b573ac7a761015daad0b7ff03b294dc60f6",
  "c36ecd2e0f38294e1290f4b9b36f602167e33614"
]);
let HashHits = union isfuzzy=true
  ( DeviceFileEvents
    | where TimeGenerated > ago(90d)
    | where SHA1 in (SparroWockyHashes)
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA1, InitiatingProcessFileName ),
  ( DeviceProcessEvents
    | where TimeGenerated > ago(90d)
    | where SHA1 in (SparroWockyHashes)
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA1, InitiatingProcessFileName );
// 2) Behavioral: non-browser processes making external web connections (C2 tasking)
let SuspiciousBeaconing = DeviceNetworkEvents
  | where TimeGenerated > ago(14d)
  | where RemotePort in (80, 443, 8080)
  | where RemoteIPType == "Public"
  | where InitiatingProcessFileName in~ ("dllhost.exe", "svchost.exe", "rundll32.exe", "regsvr32.exe")
  | summarize ConnectionCount = count(), RemoteIPs = make_set(RemoteIP), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath
  | where ConnectionCount >= 10;
HashHits;
SuspiciousBeaconing;

# SparroWocky / FamousSparrow IOC Hunt — run elevated on suspect endpoints
# Checks hash presence, Run-key persistence, suspicious scheduled tasks, and active C2-like connections

$sha1IOCs = @(
    '23e228d5603b4802398b2e7419187aef71ff9dd5',
    '2560b7e28b322bb7a56d0b1da1b2652e1efe76ea',
    '4df896624695ea2780552e9ea3c40661dc84efc8',
    '76c430b55f180a85f4e1a1e40e4a2ea37db97599',
    '873f98caf234c3a8a9db18343dad7b42117e85d4',
    'b9601e60f87545441bf8579b2f62668c56507f4a',
    'bb2f5b573ac7a761015daad0b7ff03b294dc60f6',
    'c36ecd2e0f38294e1290f4b9b36f602167e33614'
)

Write-Host "=== [1] Hash sweep of high-risk staging directories ===" -ForegroundColor Cyan
$searchPaths = @("$env:ProgramData", "$env:PUBLIC", "$env:TEMP", "$env:APPDATA")
foreach ($path in $searchPaths) {
    Get-ChildItem -Path $path -Recurse -Include *.dll,*.exe -ErrorAction SilentlyContinue | ForEach-Object {
        try {
            $h = (Get-FileHash $_.FullName -Algorithm SHA1 -ErrorAction Stop).Hash.ToLower()
            if ($sha1IOCs -contains $h) {
                Write-Host "[HIT] SparroWocky/SparrowDoor IOC: $($_.FullName) [$h]" -ForegroundColor Red
            }
        } catch {}
    }
}

Write-Host "=== [2] Registry Run-key persistence check ===" -ForegroundColor Cyan
$runKeys = @(
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce',
    'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce'
)
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        (Get-ItemProperty $key).PSObject.Properties | Where-Object {
            $_.Value -match 'ProgramData|AppData|Temp|Public' -and $_.Name -notmatch '^PS'
        } | ForEach-Object {
            Write-Host "[SUSPICIOUS] $key -> $($_.Name) = $($_.Value)" -ForegroundColor Yellow
        }
    }
}

Write-Host "=== [3] Scheduled tasks launching from user-writable paths ===" -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $actions = $_.Actions
    foreach ($a in $actions) {
        if ($a.Execute -match 'ProgramData|AppData|Temp|Public') {
            Write-Host "[SUSPICIOUS] Task '$($_.TaskName)' -> $($a.Execute) $($a.Arguments)" -ForegroundColor Yellow
        }
    }
}

Write-Host "=== [4] Active outbound connections from suspicious processes ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemotePort -in @(80,443,8080) -and $_.RemoteAddress -notmatch '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)' } |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        if ($proc.Name -match 'dllhost|rundll32|regsvr32|svchost') {
            Write-Host "[BEACON?] $($proc.Name) (PID $($proc.Id)) -> $($_.RemoteAddress):$($_.RemotePort)" -ForegroundColor Yellow
        }
    }

Write-Host "=== Hunt complete. Escalate any [HIT] findings to IR immediately. ===" -ForegroundColor Cyan