NCSC details new SparrowDoor variant with expanded capabilities

A new SparrowDoor variant discovered on a UK network in 2021 adds clipboard logging, AV detection, API hooking, and token impersonation to the persistent backdoor's capabilities.

The UK National Cyber Security Centre has published a technical malware analysis report detailing a new variant of the SparrowDoor backdoor and loader discovered on a UK network in 2021. This variant extends the capabilities of the malware originally reported by ESET in September 2021, adding significant new functionality beyond the base XOR-encoded HTTPS C2 channel.

The enhanced variant incorporates clipboard logging to capture copied data, antivirus detection capabilities to evade security tools, inline hooking of Windows API functions for evasion and persistence, and token impersonation for privilege escalation. SparrowDoor maintains its core characteristics as a persistent loader and backdoor with an XOR-encoded command-and-control channel operating beneath HTTPS traffic.

The NCSC has released indicators of compromise, STIX-formatted threat intelligence, and detection rules alongside the technical analysis to support network defenders in identifying and responding to this threat. The discovery of this enhanced variant on UK infrastructure indicates continued development and active deployment of the SparrowDoor malware family.

title: Security Software Discovery via WMIC or PowerShell AntiVirus Query
id: d86fad68-af73-573b-82ef-a857f32c2941
status: experimental
description: 'Detects enumeration of installed antivirus/security products via WMIC
  or PowerShell queries against

  the SecurityCenter2 WMI namespace. Malware such as SparrowDoor performs this check
  prior to selecting

  evasion or hooking behaviour.

  '
references:
- NCSC SparrowDoor technical analysis (2024)
logsource:
  category: process_creation
  product: windows
detection:
  selection_wmic:
    Image|endswith: \wmic.exe
    CommandLine|contains|all:
    - securitycenter2
    - antivirusproduct
  selection_ps:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains|all:
    - SecurityCenter2
    - AntiVirusProduct
  condition: 1 of selection_*
falsepositives:
- Legitimate IT asset inventory or security compliance scripts querying installed
  AV products
- Endpoint management tools performing security posture checks
level: medium
tags:
- attack.t1518.001
- attack.discovery
author: Vorant

title: Suspicious Process Access to LSASS with Token Duplication Rights
id: df5a5bc6-59ee-56d0-9ae5-df25a06af600
status: experimental
description: 'Detects processes requesting access rights to lsass.exe consistent with
  token duplication or

  impersonation (PROCESS_QUERY_INFORMATION | PROCESS_DUP_HANDLE style access masks).
  SparrowDoor

  implements token impersonation to escalate privileges after initial compromise.

  '
references:
- NCSC SparrowDoor technical analysis (2024)
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: \lsass.exe
    GrantedAccess:
    - '0x1410'
    - '0x1010'
    - '0x1438'
    - '0x1418'
    - '0x143a'
  filter_known_tools:
    SourceImage|endswith:
    - \procexp.exe
    - \procexp64.exe
    - \procmon.exe
    - \MsMpEng.exe
    - \ProcessHacker.exe
  condition: selection and not filter_known_tools
falsepositives:
- Endpoint security or diagnostic tools (Process Explorer, Process Hacker, EDR agents)
  legitimately opening handles to lsass.exe
- Credential management or SSO software performing legitimate token operations
level: high
tags:
- attack.t1134
- attack.privilege_escalation
- attack.credential_access
author: Vorant

title: Backdoor Persistence via Run Key Pointing to Non-Standard Executable Path
id: 90923df1-e472-5589-8bf2-795a23b55f06
status: experimental
description: 'Detects new autostart Run/RunOnce registry values whose data references
  an executable in a

  user-writable, temp, or ProgramData path rather than standard installed application
  directories.

  SparrowDoor''s loader establishes persistence via such autorun entries to relaunch
  the backdoor at logon.

  '
references:
- NCSC SparrowDoor technical analysis (2024)
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
    - \Software\Microsoft\Windows\CurrentVersion\Run\
    - \Software\Microsoft\Windows\CurrentVersion\RunOnce\
  suspicious_path:
    Details|contains:
    - \AppData\
    - \Temp\
    - \ProgramData\
    - \Users\Public\
  filter_known_installers:
    Details|contains:
    - OneDrive
    - Microsoft\Edge
    - Google\Update
  condition: selection and suspicious_path and not filter_known_installers
falsepositives:
- Legitimate applications that install per-user autostart entries pointing into AppData
  (e.g. update helpers, chat clients)
- Portable software launched from user-writable directories with a persistence entry
level: medium
tags:
- attack.t1547.001
- attack.persistence
author: Vorant

Source reporting: https://www.ncsc.gov.uk/report/mar-sparrowdoor