2CLoader — Loader Delivering Vidar, Remus & XWorm

Looks for: a Run or RunOnce registry value literally named SecurityHealthService.exe pointing somewhere other than the real System32 binary. FP: near zero — the exact value name colliding with an unrelated legitimate application is rare, and the real Windows binary is explicitly excluded.

// HUNT: Run/RunOnce persistence masquerading as SecurityHealthService.exe
// MITRE: T1547.001
// CONF: high
// FP: low
// COST: low
// REQUIRES: AsepValueUpdate or RegGenericValueUpdate telemetry (registry monitoring enabled)
// FALSE POSITIVES: third-party software coincidentally reusing the exact value name (not observed)
#event_simpleName=/AsepValueUpdate|RegGenericValueUpdate/
| RegObjectName = /\\Microsoft\\Windows\\CurrentVersion\\(Run|RunOnce)$/i
| RegValueName = /^SecurityHealthService\.exe$/i
| RegStringValue != /\\Windows\\System32\\SecurityHealthService\.exe$/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue])

Looks for: a scheduled task named SecurityHealthService.exe whose target executable is not the real System32 binary. FP: near zero.

// HUNT: Scheduled task persistence masquerading as SecurityHealthService.exe
// MITRE: T1053.005
// CONF: high
// FP: low
// COST: low
// REQUIRES: ScheduledTaskRegistered telemetry
// FALSE POSITIVES: none identified
#event_simpleName=ScheduledTaskRegistered
| TaskName = /^SecurityHealthService\.exe$/i
| TaskExecutable != /\\Windows\\System32\\SecurityHealthService\.exe$/i
| table([@timestamp, ComputerName, UserName, TaskName, TaskExecutable, TaskAuthor])

Looks for: modification of the HKCU Load value or the HKCU\Environment UserInitMprLogonScript value, both exceptionally rare persistence vectors regardless of the value written. FP: near zero; a small number of enterprise logon-script deployment tools legitimately use UserInitMprLogonScript.

// HUNT: Load value / logon-script persistence (rare registry locations)
// MITRE: T1547.001, T1037.001
// CONF: high
// FP: low
// COST: low
// REQUIRES: AsepValueUpdate or RegGenericValueUpdate telemetry
// FALSE POSITIVES: enterprise logon-script deployment tooling using UserInitMprLogonScript legitimately
#event_simpleName=/AsepValueUpdate|RegGenericValueUpdate/
| (RegObjectName = /\\Microsoft\\Windows NT\\CurrentVersion\\Windows$/i and RegValueName = /^Load$/i) or (RegObjectName = /\\Environment$/i and RegValueName = /^UserInitMprLogonScript$/i)
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue])

Looks for: any process named SecurityHealthService.exe actually executing from a path other than the real System32 binary, regardless of which persistence vector launched it. FP: near zero.

// HUNT: Process execution masquerading as SecurityHealthService.exe
// MITRE: T1036.005
// CONF: high
// FP: low
// COST: low
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2 telemetry
// FALSE POSITIVES: none identified
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^SecurityHealthService\.exe$/i
| ImageFileName != /\\Windows\\System32\\SecurityHealthService\.exe$/i
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData])

Looks for: a process whose displayed command line begins with svchost.exe while its on-disk image file name is not svchost.exe — the LoadPE path's command-line spoof. FP: medium — some legitimate relaunch/updater tools rewrite their own displayed command line.

// HUNT: LoadPE command-line masquerade as svchost.exe
// MITRE: T1620, T1036
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2 telemetry
// FALSE POSITIVES: internal update/relaunch tooling that intentionally rewrites its own displayed command line
// TUNING: exclude known internal packaging/update tools by SHA256HashData or ParentBaseFileName after a baseline run; validate CommandLine casing/quoting variants before promoting to Prevent
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine = /^svchost\.exe\b/i
| FileName != /^svchost\.exe$/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData])

Looks for: dllhost.exe launched without the /Processid:{GUID} switch that every legitimate DCOM-launched COM surrogate carries. FP: medium pending environment baseline — flagged medium out of caution even though no legitimate no-arg invocation pattern is documented.

// HUNT: dllhost.exe process hollowing (RunPE default target)
// MITRE: T1055.012
// CONF: high
// FP: medium
// COST: low
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2 telemetry with command-line capture
// FALSE POSITIVES: rare legacy COM scripting or management tooling that invokes dllhost.exe directly without the DCOM launcher
// TUNING: run over a 30-day baseline per host group before alerting; allowlist any confirmed legitimate no-arg dllhost.exe source by ParentBaseFileName before promoting to Prevent
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^dllhost\.exe$/i
| CommandLine != /\/Processid:/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine, SHA256HashData])

Looks for: DNS resolution of the known 2CLoader C2 domain or a direct connection to the known payload-staging IP. FP: near zero (atomic indicator); perishable as infrastructure rotates — re-run against current threat intel before relying on this long-term.

// HUNT: 2CLoader C2 domain / payload-staging IP
// MITRE: T1071.001
// CONF: high
// FP: low
// COST: low
// REQUIRES: DnsRequest and/or NetworkConnectIP4 telemetry
// FALSE POSITIVES: none identified (atomic indicator)
#event_simpleName=/DnsRequest|NetworkConnectIP4/
| (DomainName = /^aware-cr1\.com$/i) or (RemoteAddressIP4 = "62.60.226.185")
| table([@timestamp, ComputerName, UserName, DomainName, RemoteAddressIP4, RemotePort, ContextBaseFileName])

Looks for: host/destination pairs connecting on a regular 5-minute cadence for over an hour with a low per-bucket connection count, a shape consistent with 2CLoader's periodic HTTP POST status beacon, regardless of which IP it is currently using. FP: medium — legitimate SaaS sync/telemetry clients poll on similar cadences; tune with the ContextBaseFileName projection.

// HUNT: Periodic beaconing consistent with 2CLoader's HTTP POST status reporting
// MITRE: T1071.001, T1132.002
// CONF: medium
// FP: medium
// COST: medium
// REQUIRES: NetworkConnectIP4 telemetry
// FALSE POSITIVES: legitimate cloud-sync, telemetry, or EDR-agent callback traffic with similar polling cadence
// TUNING: exclude known-benign ContextBaseFileName values (sync clients, update agents, the EDR sensor itself) after baselining; raise BucketsActive / lower AvgConnsPerBucket thresholds to fit environment norms
// LOOKBACK: 7d -- set the window with the console time picker
#event_simpleName=NetworkConnectIP4
| !cidr(RemoteAddressIP4, subnet="10.0.0.0/8")
| !cidr(RemoteAddressIP4, subnet="172.16.0.0/12")
| !cidr(RemoteAddressIP4, subnet="192.168.0.0/16")
| Bucket5m := @timestamp - (@timestamp % 300000)
| groupBy([ComputerName, RemoteAddressIP4, ContextBaseFileName, Bucket5m], function=count(as=ConnsInBucket), limit=20000)
| groupBy([ComputerName, RemoteAddressIP4, ContextBaseFileName], function=[count(as=BucketsActive), avg(ConnsInBucket, as=AvgConnsPerBucket)], limit=5000)
| BucketsActive > 12
| AvgConnsPerBucket < 5
| sort(BucketsActive, order=desc)
| table([ComputerName, RemoteAddressIP4, ContextBaseFileName, BucketsActive, AvgConnsPerBucket])

Looks for: exact SHA-256 match against the 20 known 2CLoader samples published by Zscaler ThreatLabz. FP: near zero (exact hash); perishable as new builds get new hashes — re-run against updated hash feeds, not a one-time check.

// HUNT: Known 2CLoader sample hash sweep
// MITRE: Indicator Match (supports all TTPs in this pack)
// CONF: high
// FP: low
// COST: low
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2 telemetry
// FALSE POSITIVES: none identified (exact hash match)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| in(field=SHA256HashData, values=["5edcaa75a28e5cd700bf7643b275fe5d28649aa41a0711f391ec1fca795a4e8a","0017821181723261801e24abb9d33c739f382889d46dbf46d320c87ac62e5ca6","06185d74edbdc06f99095e96f74aa2e49a1cda2d02a294c11a9ac35a0231075e","066d83b98a2081e0bb075c94376aebc9b0fd6499025cab1762d83bbb4d7576c6","0a2ef2c360cf6e3e3e5d844ca03fecc31924ba0e8c3ecd8aefa778cae10fb19e","0d2abd7d872196abd951f1d7ed6406486499e5d5acc04f28fcd4f45b1851711e","0e4d6c385922938ecc1962dbc7e5950b086459b172b70a945414cffe4395aa27","0ee6df8a309443c86c0bba8b376f39531513d3451b46bebd4b79bb9d5bf8dcb1","1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb","1447ed0893b9095f671e2f35a2a0127890040b5459534813b0f83c3e1fffa0bf","1b195181a2603b0b2608d49134af8c170225c2e06873c1fe5cd537db9018807f","246717653bc2ae2e09036bac56c9d79940c652972a73f4c6aa9b925c28cce095","2ad9b5e1c9952e95cfa55a4255e952962b6208ae1ca610caf1c7c2383be7e74b","2c786f7009cc5e1fba5471a88b23b34dce6e1578ee9f664ec62bf48227ba384b","2d43d592630ad1e012da63ef7279f95dd4a8e94964e12ca2f996051875574fa6","30cf47caf9700a74a8ea4a728b8b7c88cb1f8e22261b4ac01575b112c1e224ca","3286ff477ccd888479b96d0ffb2bd53962862db7267a4bd1c8d8f8c22fec63d4","331fd58d489e9fb888a5e4193d0e36f6ff29063808c59a164d98e26835054972","45d46e7064ba4b4cb578659f73ee354ad26cf2cc1e7f59bd3d15028e1e46a38b","4c16f5ebd5c633b7a793ffa2cd96daddc5a503d82ed4fbe636109d89164ec02b"])
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, SHA256HashData, ParentBaseFileName])

Looks for: mscoree.dll, clr.dll, clrjit.dll, mscorlib.ni.dll, or mscoreei.dll loaded into a process that is not a recognized .NET host, consistent with 2CLoader's CLR-hosting execution path (fl 0x2). FP: medium — legitimate in-house .NET line-of-business tools and .NET-based agents will also trip this.

// HUNT: CLR hosting of a .NET payload by a non-.NET process
// MITRE: T1620, T1055
// CONF: medium
// FP: medium
// COST: medium
// REQUIRES: ImageHash telemetry correlated with ProcessRollup2 on aid + TargetProcessId
// FALSE POSITIVES: legitimate in-house .NET applications, .NET-based backup/agent/management software
// TUNING: extend the FileName exclusion list with your environment's known legitimate .NET hosts after a baseline run; validate before promoting beyond Investigate-only
#event_simpleName=ImageHash
| rename(field=[[FileName, Dll_Loaded], [FilePath, Dll_Path]])
| selfJoinFilter(field=[aid, TargetProcessId], where=[
    {#event_simpleName = /ProcessRollup2/},
    {FileName != /(powershell|pwsh|dotnet|w3wp|devenv|MSBuild)\.exe/i},
    {#event_simpleName = ImageHash}
])
| in(field=Dll_Loaded, values=["mscoree.dll", "clr.dll", "clrjit.dll", "mscorlib.ni.dll", "mscoreei.dll"], ignoreCase=true)
| groupBy([aid, ComputerName, TargetProcessId], function=collect([FileName, CommandLine, Dll_Loaded, Dll_Path]))