NCSC details new SparrowDoor backdoor variant

25 April 2022 medium threat

NCSC published a technical analysis of a new SparrowDoor backdoor variant found on a UK network, adding clipboard logging and API hooking.

The UK's National Cyber Security Centre released a malware analysis report on a newly identified variant of SparrowDoor, a persistent loader and backdoor first reported by ESET in September 2021. The variant analysed by NCSC was discovered on a UK network in 2021 and includes enhanced capabilities beyond the originally documented sample, including clipboard logging, antivirus detection, inline hooking of Windows API functions, and token impersonation for privilege manipulation.

SparrowDoor communicates with its command-and-control infrastructure using XOR-encoded traffic tunnelled beneath HTTPS, a technique intended to blend malicious traffic with legitimate encrypted web sessions. The report is accompanied by indicators of compromise, STIX objects, and detection rules to support defenders in identifying the malware on their networks.

No specific threat actor, campaign, or victim sector is attributed in the NCSC advisory beyond noting the sample's discovery on a UK network; the report is primarily technical in nature, intended to aid detection and response rather than describe an active, ongoing campaign.

Mentioned in this report

Malware SparrowDoor

Detection guidance

Process Accessing Clipboard Data via API

ATT&CK T1115

Detection of processes using clipboard access APIs (GetClipboardData, OpenClipboard) - typical of clipboard logging backdoors. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Process Accessing Clipboard Data via API
description: Detects processes hooking or calling clipboard access APIs (GetClipboardData,
  OpenClipboard) via inline API monitoring or DLL injection patterns. SparrowDoor
  variants use clipboard logging for credential/data theft.
tags:
- attack.collection
- attack.t1115
logsource:
  category: image_load
  product: windows
detection:
  selection_clipboard_dll:
    ImageLoaded|endswith:
    - \user32.dll
    Image|endswith:
    - \svchost.exe
    - \lsass.exe
    - \winlogon.exe
    CallTrace|contains:
    - GetClipboardData
    - OpenClipboard
  filter_legitimate:
    Image|endswith:
    - \explorer.exe
    - \mstsc.exe
    - \notepad.exe
  condition: selection_clipboard_dll and not filter_legitimate
falsepositives:
- Legitimate clipboard management utilities
- Accessibility tools that interact with clipboard
level: medium
id: 2ba06c21-d55c-5384-89cd-1e677b1deb77
status: experimental
author: Vorant

Process Token Impersonation via Winlogon or System Services

ATT&CK T1134

Detection of token impersonation (DuplicateToken, ImpersonateLoggedOnUser) by non-standard processes - technique used by SparrowDoor for privilege escalation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Process Token Impersonation via Winlogon or System Services
description: Detects calls to token impersonation APIs (DuplicateToken, ImpersonateLoggedOnUser,
  SetThreadToken) from user-mode processes. SparrowDoor uses token impersonation to
  escalate privileges and execute commands in different security contexts.
tags:
- attack.privilege-escalation
- attack.defense-evasion
- attack.t1134
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \winlogon.exe
    - \svchost.exe
    - \lsass.exe
    CommandLine|contains:
    - DuplicateToken
    - ImpersonateLoggedOnUser
    - SetThreadToken
  filter_admin:
    User|contains: SYSTEM
  condition: selection and not filter_admin
falsepositives:
- Legitimate privilege escalation by Windows components
- Security software performing token operations
level: high
id: d8edf872-96c6-5bb5-85c4-cffe94e5f814
status: experimental
author: Vorant

XOR-Encoded HTTPS Traffic to Suspicious Destinations

ATT&CK T1071.001

Detection of HTTPS connections with suspicious payload patterns or anomalous TLS certificate characteristics - obfuscated C2 communication. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: XOR-Encoded HTTPS Traffic to Suspicious Destinations
description: Detects encrypted HTTPS traffic (port 443) from system processes or injected
  processes with anomalous certificate or session patterns, indicative of C2 over
  HTTPS. SparrowDoor tunnels XOR-encoded payloads beneath HTTPS to evade detection.
tags:
- attack.command-and-control
- attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Image|endswith:
    - \svchost.exe
    - \lsass.exe
    - \winlogon.exe
    - \rundll32.exe
    Initiated: 'true'
  filter_legitimate_tls:
    DestinationHostname|contains:
    - microsoft.com
    - windows.com
    - apple.com
    - google.com
  condition: selection and not filter_legitimate_tls
falsepositives:
- Legitimate system services checking for updates over HTTPS
- Corporate proxy or security appliance health checks
level: medium
id: c689f970-2b49-5453-acd9-a33d6113c5b5
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ncsc.gov.uk/report/mar-sparrowdoor

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free