NCSC details new SparrowDoor backdoor variant

Published25 April 2022 Vorant ratingroutine threat

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

NCSC published a technical analysis of a new SparrowDoor backdoor variant found on a UK network, adding clipboard logging and API hooking.

Sourcencsc.gov.uk — open the original

What to check

Applies to: Whether this concerns you is not assessed; the names the report mentions are listed below.

The UK's National Cyber Security Centre released a malware analysis report on a newly identified variant of SparrowDoor, a persistent loader and backdoor first reported by ESET in September 2021. The variant analysed by NCSC was discovered on a UK network in 2021 and includes enhanced capabilities beyond the originally documented sample, including clipboard logging, antivirus detection, inline hooking of Windows API functions, and token impersonation for privilege manipulation.

SparrowDoor communicates with its command-and-control infrastructure using XOR-encoded traffic tunnelled beneath HTTPS, a technique intended to blend malicious traffic with legitimate encrypted web sessions. The report is accompanied by indicators of compromise, STIX objects, and detection rules to support defenders in identifying the malware on their networks.

No specific threat actor, campaign, or victim sector is attributed in the NCSC advisory beyond noting the sample's discovery on a UK network; the report is primarily technical in nature, intended to aid detection and response rather than describe an active, ongoing campaign.

Mentioned in this report

Malware SparrowDoor

Detection guidance

Process Token Impersonation via Winlogon or System Services

ATT&CK T1134 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detection of token impersonation (DuplicateToken, ImpersonateLoggedOnUser) by non-standard processes - technique used by SparrowDoor for privilege escalation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Process Token Impersonation via Winlogon or System Services
description: Detects calls to token impersonation APIs (DuplicateToken, ImpersonateLoggedOnUser,
  SetThreadToken) from user-mode processes. SparrowDoor uses token impersonation to
  escalate privileges and execute commands in different security contexts.
tags:
- attack.privilege-escalation
- attack.stealth
- attack.t1134
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \winlogon.exe
    - \svchost.exe
    - \lsass.exe
    CommandLine|contains:
    - DuplicateToken
    - ImpersonateLoggedOnUser
    - SetThreadToken
  filter_admin:
    User|contains: SYSTEM
  condition: selection and not filter_admin
falsepositives:
- Legitimate privilege escalation by Windows components
- Security software performing token operations
level: high
id: d8edf872-96c6-5bb5-85c4-cffe94e5f814
status: experimental
author: Vorant

XOR-Encoded HTTPS Traffic to Suspicious Destinations

ATT&CK T1071.001 · status experimental · needs windows network_connection logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detection of HTTPS connections with suspicious payload patterns or anomalous TLS certificate characteristics - obfuscated C2 communication. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: XOR-Encoded HTTPS Traffic to Suspicious Destinations
description: Detects encrypted HTTPS traffic (port 443) from system processes or injected
  processes with anomalous certificate or session patterns, indicative of C2 over
  HTTPS. SparrowDoor tunnels XOR-encoded payloads beneath HTTPS to evade detection.
tags:
- attack.command-and-control
- attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Image|endswith:
    - \svchost.exe
    - \lsass.exe
    - \winlogon.exe
    - \rundll32.exe
    Initiated: 'true'
  filter_legitimate_tls:
    DestinationHostname|contains:
    - microsoft.com
    - windows.com
    - apple.com
    - google.com
  condition: selection and not filter_legitimate_tls
falsepositives:
- Legitimate system services checking for updates over HTTPS
- Corporate proxy or security appliance health checks
level: medium
id: c689f970-2b49-5453-acd9-a33d6113c5b5
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ncsc.gov.uk/report/mar-sparrowdoor

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs