CleanUpLoader / Oyster Backdoor

What happened: Red Canary elevated CleanUpLoader—also tracked as Oyster, Broomstick, OysterLoader, and related names—in its 2026 Threat Detection Report after observing poisoned-search and malvertising delivery through fake PuTTY and other administrative-tool pages. Rapid7 independently analyzed a fake Microsoft Teams installer chain in 2024, Microsoft published OysterLoader behavior and indicators, and Sekoia documented a 2026 multi-stage evasion variant. These sources corroborate the family while showing that filenames, task names, packaging, and protocol details vary by campaign.

How it works: a user searching for PuTTY, WinSCP, Teams, or another utility reaches a lookalike landing page or advertisement and runs a trojanized installer from a user-writable path. Observed chains write DLL payloads such as twain_96.dll or CleanUp30.dll and create recurring tasks—WindowsCodecs, BluetoothDesktopHandlers, Security Updater, or ClearMngs—that invoke rundll32 with DLLRegisterServer against an AppData or temporary DLL. Follow-on execution can launch net, nltest, systeminfo, ipconfig, or whoami for discovery. Reported Oyster traffic uses generic api/connect or api/session-style HTTP paths and encoded content, but endpoint DNS events cannot prove that application-layer protocol.

Why detection belongs on behavior: search advertisements, landing domains, filenames, and C2 names rotate, while signed or plausible installers can still be hostile. The stronger defensive sequence combines administrative-tool installers launched from Downloads/AppData/Temp, schtasks creating a rundll32 DLLRegisterServer action, source-named scheduled tasks, and discovery children from the suspicious lineage. Five CQL queries expose those process, task, and historical DNS pivots. HTTP URI/content, signer certificate identity, DLL export semantics, IPv6, and wrapper ancestry remain tenant-specific gaps.

Operational consequence: Oyster establishes recurring execution and a remote tasking foothold that can outlive removal of the original installer. Preserve task XML, DLLs and hashes, process trees, browser/download provenance, DNS/proxy records, and user context before disabling persistence. Historical domains should be hunted and time-bounded rather than presented as permanent blocks. Prevention should center on managed software distribution and audit-mode application control, with narrow rollback paths for legitimate legacy installers.

Only sanitized plain-text evidence from the current run is retained. Source pages were treated as untrusted data; no embedded instructions, commands, scripts, credentials, or active content were used.

Claim ledger

The chain is evidence-led: product or lure execution, placement and persistence, command behavior, and remote communications are kept separate so an analyst can stop at the strongest corroborated step.

Hypotheses

Affected surface and telemetry

Coverage assumes managed Windows endpoints with ProcessRollup2, ScheduledTaskRegistered, and DnsRequest where populated, plus native task, browser, DNS, proxy, and application-control records. Direct-parent depth, non-PE file writes, signer certificate identity, HTTP content, IPv6, and tenant field population require environment-specific confirmation.

Indicators below are source-bound historical hunt pivots, not proof of compromise or timeless block entries. Require behavior, host, user, process, and timing context; assign review/expiry dates to infrastructure.

ATT&CK rows describe attacker behavior supported by named claims. Every mapping is explicitly an analyst inference; neither product inventory nor hardening is mislabeled as adversary behavior.

These native pivots supply evidence that portable endpoint CQL cannot safely invent. Complete them alongside the query set and preserve original records before remediation.

All queries are static-only. Start with a one-hour manual window, confirm the repository, fields, and row semantics, then expand to the documented lookback.

// HUNT: User-path administrative-tool installers
// HYPOTHESIS: H01
// USE: hunt
// MITRE: T1036
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 30d — review intermittent fake-installer delivery
// REQUIRES: #event_simpleName=ProcessRollup2; ImageFileName, CommandLine, ParentBaseFileName
// FALSE POSITIVES: legitimate PuTTY, WinSCP, Teams, and deployment installers
// TUNING: exclude approved vendor paths and software-distribution parents
// VALIDATION: STATIC-ONLY
#event_simpleName = ProcessRollup2
| test(@timestamp >= now() - 2592000000)
| ImageFileName = /\\(putty|winscp|msteam(?:s|ssetup)[^\\]*)\.exe$/i
| ImageFileName = /\\users\\[^\\]+\\(?:downloads|appdata|temp)\\/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, SHA256HashData, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Scheduled rundll32 AppData DLL persistence
// HYPOTHESIS: H02
// USE: alert-candidate
// MITRE: T1053.005, T1218.011
// CONF: high
// FP: medium
// COST: low
// TIMEFRAME: 30d — recurring persistence remains durable
// REQUIRES: #event_simpleName=ProcessRollup2; ImageFileName, CommandLine, ParentBaseFileName
// FALSE POSITIVES: legacy installers that create rundll32 tasks
// TUNING: exclude approved task creators and signed DLLs in managed paths
// VALIDATION: STATIC-ONLY
#event_simpleName = ProcessRollup2
| test(@timestamp >= now() - 2592000000)
| ImageFileName = /\\schtasks\.exe$/i
| CommandLine = /\/create/i
| CommandLine = /rundll32(?:\.exe)?/i
| CommandLine = /\\users\\[^\\]+\\appdata\\roaming\\/i
| CommandLine = /\.dll\s+dllregisterserver/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine, SHA256HashData, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Source-named Oyster scheduled tasks
// HYPOTHESIS: H03
// USE: hunt
// MITRE: T1053.005
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 90d — source-name persistence sweep
// REQUIRES: #event_simpleName=ScheduledTaskRegistered; ScheduledTaskName, TaskName, TaskExecutable
// FALSE POSITIVES: legitimate tasks using generic update or codec names
// TUNING: exclude owner-approved tasks only after verifying executable and path
// VALIDATION: STATIC-ONLY
#event_simpleName = ScheduledTaskRegistered
| test(@timestamp >= now() - 7776000000)
| ScheduledTaskName = /^(WindowsCodecs|BluetoothDesktopHandlers|Security Updater|WMSysPr9|FireFox Agent INC|ClearMngs)$/i
| table([@timestamp, ComputerName, UserName, ScheduledTaskName, TaskName, TaskExecutable, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Oyster-lineage discovery children
// HYPOTHESIS: H04
// USE: hunt
// MITRE: T1082, T1016
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 14d — recent discovery correlation
// REQUIRES: #event_simpleName=ProcessRollup2; ParentBaseFileName, ImageFileName, CommandLine
// FALSE POSITIVES: administrator troubleshooting and inventory agents
// TUNING: exclude approved management tooling and documented scripts
// VALIDATION: STATIC-ONLY
#event_simpleName = ProcessRollup2
| test(@timestamp >= now() - 1209600000)
| ParentBaseFileName = /^(rundll32|msteamss?setup_c_l_|putty|winscp)\.exe$/i
| ImageFileName = /\\(net|nltest|systeminfo|ipconfig|whoami)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Historical Oyster C2 DNS hits
// HYPOTHESIS: H05
// USE: hunt
// MITRE: T1071.001
// CONF: high
// FP: low
// COST: low
// TIMEFRAME: 90d — historical C2 indicator sweep
// REQUIRES: #event_simpleName=DnsRequest; DomainName, ContextBaseFileName, ContextProcessId_decimal
// FALSE POSITIVES: research and sinkhole lookups
// VALIDATION: STATIC-ONLY
#event_simpleName = DnsRequest
| test(@timestamp >= now() - 7776000000)
| in(DomainName, values=["supfoundrysettlers.us","whereverhomebe.com","retdirectyourman.eu"])
| table([@timestamp, ComputerName, DomainName, ContextBaseFileName, ContextProcessId_decimal, aid])
| sort(@timestamp, order=desc, limit=1000)

Stage 4 is deliberately degraded: every candidate remains hunt-only and design-only because no tenant parse, positive test, benign baseline, suppression, volume, routing, owner, or SLA evidence exists. No Custom IOA or scheduled alert is shipped.

Promotion gate

Confirm tenant parsing and populated fields; run safe positive and representative benign tests; measure prevalence and cost; define grouping, deduplication, suppressions, routing, owner, SLA, and rollback; then re-review independently.

CSV-style copy blocks retain source IDs and context. Historical infrastructure is supplied for retrospective hunting only; validate ownership and expiry before any prevention action.

type,value,action,severity,expiration,description,tags
task,WindowsCodecs,detect,medium,2027-09-04,observed persistence task,source:S01
task,BluetoothDesktopHandlers,detect,medium,2027-09-04,observed persistence task,source:S01
task,Security Updater,detect,medium,2027-09-04,observed persistence task,source:S01
domain,putty-ssh.com,detect,medium,2026-12-04,historical fake PuTTY landing domain,source:S01
domain,putty.run,detect,medium,2026-12-04,historical fake PuTTY landing domain,source:S01
path,MSTeamsSetup_c_l_.exe,detect,medium,2027-09-04,historical fake Teams installer,source:S02 source:S03
path,CleanUp30.dll,detect,medium,2027-09-04,historical Oyster DLL,source:S02 source:S03
task,ClearMngs,detect,medium,2027-09-04,historical persistence task,source:S03
mutex,ITrkfSaV-4c7KwdfnC-Ds165XU4C-lH6R9pk1,detect,medium,2027-09-04,historical mutex,source:S03
domain,supfoundrysettlers.us,detect,medium,2026-12-04,historical C2 domain,source:S03
domain,whereverhomebe.com,detect,medium,2026-12-04,historical C2 domain,source:S03

WindowsCodecs,sources=S01,context=observed persistence task,volatility=medium
BluetoothDesktopHandlers,sources=S01,context=observed persistence task,volatility=medium
Security Updater,sources=S01,context=observed persistence task,volatility=medium
ClearMngs,sources=S03,context=historical persistence task,volatility=medium

putty-ssh.com,sources=S01,context=historical fake PuTTY landing domain,volatility=high
putty.run,sources=S01,context=historical fake PuTTY landing domain,volatility=high
supfoundrysettlers.us,sources=S03,context=historical C2 domain,volatility=high
whereverhomebe.com,sources=S03,context=historical C2 domain,volatility=high

MSTeamsSetup_c_l_.exe,sources=S02+S03,context=historical fake Teams installer,volatility=medium
CleanUp30.dll,sources=S02+S03,context=historical Oyster DLL,volatility=medium

ITrkfSaV-4c7KwdfnC-Ds165XU4C-lH6R9pk1,sources=S03,context=historical mutex,volatility=medium

Deployable playbook · CTRL01 + CTRL02

1. Confirm incident authority, owner, business dependencies, evidence storage, and recovery path.
2. Capture task definitions, process trees, files and hashes, DNS/network records, user/session state, and current policy before change.
3. Pilot the containment or domain/task change on one confirmed endpoint or small cohort.
4. Verify the expected malicious behavior stops and evidence remains accessible.
5. Run application, authentication, network, and user workflow health checks.
6. Expand only to confirmed matching systems after the pilot remains healthy.
7. If a stop condition occurs, apply the documented narrow rollback and verify restored service without reintroducing suspect artifacts.
8. Retain before/after exports, approvals, test evidence, and owner sign-off.

Deployable playbook · CTRL03 + CTRL05

1. Inventory approved applications, publishers, install paths, owners, and exception requirements.
2. Export current application-control policy and confirm a tested rollback channel.
3. Deploy the new policy to an isolated audit-only pilot.
4. Exercise approved applications and harmless representative tests; review every unexpected audit event.
5. Verify business workflows, software updates, and developer exceptions.
6. Promote narrowly only when audit data and owners support each allow/deny decision.
7. Rollback to the previous signed policy if a critical application fails and verify endpoint health.
8. Retain policy hashes, audit samples, approvals, exceptions, and review dates.

Continuity rule: preserve evidence first. Do not isolate critical systems, remove tasks/files, revoke credentials, or impose application-control enforcement without incident authority, the service owner, known dependencies, and a tested recovery path.

Validation state: STATIC REVIEW PASSED after local structure/safety, field/event, CQL syntax, and source-snapshot provenance gates. The offline dry run records extraction and profile readiness only; it does not contact Falcon or prove parsing, detection, canary success, or deployment.

Recorded gaps and next evidence

• Every query remains tenant-unverified and design-only.
• Direct-parent lineage, field population, IPv6, proxy content, and environment-specific exclusions require tenant review.
• Historical atomics require context and expiry; no query result was generated by this build.
• Next step: run the named DO FIRST query manually for one hour, confirm fields and semantics, then record positive and benign tests before promotion.