DOUBLECUP — ClickFix Loader-as-a-Service

DOUBLECUP is a Russian Loader-as-a-Service sold to ClickFix operators, assessed active since early June 2026 and documented by SOCRadar's Threat Research Unit on 2026-08-03. It is not a malware family. It is delivery infrastructure. Operators buy a license and a Go-based Windows GUI client, paste generated frontend code into their own lure pages, and DOUBLECUP handles the rest: hosting the steganographic PNG, session tracking, encryption keys and automatic stub rebuilds. Observed campaigns run through a cluster of fake CRM login pages impersonating NetSuite, Odoo, HubSpot and Salesforce, which inject the loader through embedded iframes.

The attacker objective is straightforward payload delivery at scale with minimal forensic residue. The chain is built so that almost nothing lands on disk in a form a scanner can judge. The payload arrives as an ordinary PNG in the browser cache, is located by exact file size and carved out with findstr or certutil, and the final stage is decrypted in memory using a custom SHA-256 stream cipher in CTR mode plus bitwise XOR, keyed on the victim's own public IPv4 address passed through PBKDF2. That last detail is the important one for defenders: a sample pulled into a sandbox or detonated from any other network derives the wrong key and simply fails to decrypt, so the payload is never revealed to an analyst.

Two final payloads have been observed. CountLoader 4.5p ships as fileless PowerShell for Windows and a cross-compiled Mach-O for macOS. Its notable new trick is process masquerading: it copies conhost.exe, powershell.exe and mshta.exe out of System32 into a user-writable directory, renames them after a harvested autostart application, and overwrites the UTF-16LE PE metadata fields (OriginalFilename, InternalName, FileDescription) so both name-based and header-based inspection are defeated. It persists through two redundant 25-minute scheduled tasks, audits browser extensions for crypto wallets, and profiles the host for Signal Desktop. DeviceManager is a previously undocumented modular Python RAT delivered as a Delphi-compiled Inno Setup installer that unpacks a full embedded Python runtime. It persists through scheduled tasks or WMI Event Subscriptions, resolves its live C2 from an Ethereum/Polygon smart contract via EtherHiding, and tunnels over DNS A and TXT records with a hardcoded microsoft.com apex appended so the traffic reads as ordinary Microsoft telemetry in a DNS log.

Highest-value defensive angle. Despite the sophistication of the packaging, the chain has two mandatory, unavoidable steps that no amount of operator-side obfuscation removes: a human pastes a command into the Run dialog, and a local shell then reads a file out of a browser cache directory. Both are cheap to detect and neither depends on an indicator the operator can rotate. Removing the Run dialog by policy and blocking the browser clipboard-write permission removes the delivery mechanism outright rather than detecting it after the fact.

Defender priority: treat the IP and domain list here as retro-hunt and blocklist material, not as the detection. DeviceManager resolves its C2 from a smart contract, so the operator rotates infrastructure by writing one blockchain transaction without redeploying a single implant. The durable coverage is Q1 (cache carve), Q2 (wildcard LOLBin), Q3 (renamed conhost) and Q5 (impostor task names). Deploy those first.

Collection notes

• Primary source access. The SOCRadar article returned HTTP 403 to the automated fetcher and then a bot-check interstitial. It was retrieved on a later attempt once the interstitial cleared on its own. No bot protection was bypassed or solved. All three threat-intel sources are snapshotted verbatim alongside this pack.
• Prompt-injection screen. Every fetched page was screened for text addressed to an automated agent (instructions to run commands, fetch further URLs for "the real IOCs", or claims of authorisation). None was found. No source was dropped.
• Date discrepancy. SOCRadar's own page is dated Aug 03, 2026 and BleepingComputer published the same day. The Hacker News carries Aug 04, 2026. Treated as a 2026-08-03 publication with next-day syndication. Nothing detection-relevant turns on this.
• Actor handle discrepancy. The primary names the operator Rognar with Telegram handle @johnysilverhe (single n). The Hacker News renders it johnnysilverhe (double n) as the VS Code marketplace publisher. Both spellings are recorded. Neither is a detection input, but if you pivot on the marketplace publisher, search both.
• Deliberately not carried forward. The Web3 RPC endpoints DeviceManager contacts (Sepolia, Polygon and Ethereum mainnet public nodes) are named only by network in the source, not by provider hostname. No RPC provider domain is shipped as an indicator, because blocking a public RPC endpoint is both over-broad and unsupported by the source.
• Abused legitimate infrastructure. DeviceManager was staged on Seagate Lyve object storage. The full object URL ships as an indicator. The seagate.com apex must not be blocked.

Attack chain

Hunt hypotheses, ordered by fidelity

Unmappable chain steps (carried into the Coverage Map as gaps): the in-memory PBKDF2 key derivation and reflective .NET load at step 6 produce no distinct Falcon event. DeviceManager's WMI Event Subscription persistence at step 8b is built through direct ole32/oleaut32 COM calls precisely to avoid a wmic.exe or powershell.exe process ancestor, so process-lineage detection does not see it. Both are covered by native audit-log hunts and by preventive controls instead.

All indicators below are drawn from the SOCRadar primary report and are traceable to the saved source snapshots shipped with this pack. Expiry follows the pack convention: detect plus six months, hunt plus three months.

Network

Blockchain (EtherHiding)

File hashes (SHA-256)

Host artifacts

DOUBLECUP itself is browser-resident and platform-agnostic. The payloads split by operating system: CountLoader covers Windows and macOS, DeviceManager is Windows only. Nothing in this chain requires local administrator rights, so a standard user endpoint is fully sufficient for the attacker.

Mapping as published by the vendor, with the covering query or control from this pack added to each row.

These cover the parts of the chain that Falcon telemetry sees poorly or not at all. Run them alongside the CQL section, not instead of it.

N1. Run dialog history (the ClickFix paste itself)

The Run dialog records what the user typed. This is the single highest-value forensic artifact for confirming a ClickFix infection, and it survives the malware self-deleting.

Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Look for values containing any of:
  findstr        certutil        %~z
  -NoP -W Hidden -EP B -C -      (the DOUBLECUP stage-1 PowerShell switch cluster)
  "User Data"    AppData\Local   f_

Collect fleet-wide:
  Get-ChildItem 'HKU:\' | ForEach-Object {
    $p = "$($_.PSPath)\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
    if (Test-Path $p) { Get-ItemProperty $p }
  }

N2. PowerShell script-block logging (EID 4104)

Stage 2 and CountLoader are fileless. Script-block logging is the only place their decrypted bodies are ever written down. If 4104 is not enabled, see HRD-5 in Hardening, then re-run this hunt once logs accumulate.

Log:  Microsoft-Windows-PowerShell/Operational, Event ID 4104

Search decoded ScriptBlockText for:
  FromBase64String        System.Reflection.Assembly
  -bxor                   PBKDF2 / Rfc2898DeriveBytes
  Schedule.Service        GoogleUpdateService     MSEdgeUpdateService
  approveUpdate           getUpdates
  Ledger Live             BitBox02        KeepKey
  irm                     iex

Note: CountLoader 4.5p deliberately avoids ConvertFrom-Json and uses a regex JSON
parser to stay under AMSI heuristics, so do NOT rely on ConvertFrom-Json as a marker.

N3. WMI Event Subscription persistence (the EDR gap)

DeviceManager builds this through direct ole32 and oleaut32 COM calls rather than wmic.exe or PowerShell, specifically so that process-lineage detections do not fire. The WMI operational log and a direct namespace query are the reliable checks.

Log:  Microsoft-Windows-WMI-Activity/Operational, Event ID 5861
      (also 5859 and 5860 for consumer and filter registration)

Direct namespace audit, run fleet-wide and diff against a known-good baseline:
  Get-WmiObject -Namespace root\subscription -Class __EventFilter
  Get-WmiObject -Namespace root\subscription -Class CommandLineEventConsumer
  Get-WmiObject -Namespace root\subscription -Class __FilterToConsumerBinding
  Get-WmiObject -Namespace root\subscription -Class __IntervalTimerInstruction

DOUBLECUP-specific names to alert on:
  __EventFilter                 PythonAppUpdateFilter
  CommandLineEventConsumer      PythonAppUpdateConsumer
  __IntervalTimerInstruction    PythonAppTimer_600   (600000 ms interval)

Any CommandLineEventConsumer whose CommandLineTemplate references pythonw.exe or a
path under %LOCALAPPDATA% warrants investigation regardless of its name.

N4. Scheduled task audit (EID 4698 and on-disk XML)

Log:  Security, Event ID 4698 (task created), 4702 (task updated)
      Requires "Audit Other Object Access Events" to be enabled. See HRD-9.

On-disk task definitions:
  C:\Windows\System32\Tasks\

Alert on task names matching:
  GoogleUpdateService*     MSEdgeUpdateService*     MicroUpdaterV1     PythonAppUpdater

These are impostors. The genuine vendor tasks are named:
  GoogleUpdateTaskMachineCore / GoogleUpdateTaskMachineUA
  MicrosoftEdgeUpdateTaskMachineCore / MicrosoftEdgeUpdateTaskMachineUA
so a substring match on "GoogleUpdate" alone will produce noise. Match the full prefix.

Also flag any task whose action runs a binary from %USERPROFILE% or %LOCALAPPDATA%,
or whose settings combine WakeToRun with a repetition interval under 30 minutes.

N5. Browser cache carve artifacts

Cache locations (per browser profile):
  Chrome  %LOCALAPPDATA%\Google\Chrome\User Data\Default\Cache\Cache_Data\
  Edge    %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\
  Brave   %LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\
  Opera   %APPDATA%\Opera Software\Opera Stable\Cache\
  Firefox %LOCALAPPDATA%\Mozilla\Firefox\Profiles\<profile>\cache2\entries\

Chromium cache entries are named f_XXXXXX. The DOUBLECUP command locates the payload
by EXACT byte size, so the hunt is: any f_* entry whose size matches across multiple
unrelated hosts is a staged payload, not organic browsing.

Triage: carve any f_* entry written within 120 seconds of a cmd.exe or powershell.exe
start on the same host, and check for a PNG header followed by a large ASCII region.
The reference sample used a marker string of ZZ1984 as the findstr needle.

N6. macOS LaunchAgent audit

Persistence path:  ~/Library/LaunchAgents/*.plist

Audit:
  ls -la ~/Library/LaunchAgents/ /Library/LaunchAgents/
  launchctl list

Flag any plist whose ProgramArguments reference a binary in ~/Library, /tmp,
/var/folders or the user Downloads directory, or any plist with no matching
installed application. Cross-check against your MDM's approved LaunchAgent inventory.

Supporting reconnaissance commands used by the Mach-O build:
  /usr/bin/sw_vers -productVersion
  system_profiler SPHardwareDataType
  ioreg -rd1 -c IOPlatformExpertDevice
  /usr/bin/curl   (HTTP POST and binary retrieval)

N7. Browser shortcut integrity

The .lnk rewrite capability is present but never invoked in the analysed sample, so treat this as a low-yield check that costs almost nothing to run. It becomes important if the operator ships a build where the function is wired up.

Scan the desktop and Start Menu for browser shortcuts whose target is not the
browser executable:

  Get-ChildItem "$env:USERPROFILE\Desktop","$env:APPDATA\Microsoft\Windows\Start Menu" `
    -Filter *.lnk -Recurse | ForEach-Object {
      $sc = (New-Object -ComObject WScript.Shell).CreateShortcut($_.FullName)
      [pscustomobject]@{ Link = $_.FullName; Target = $sc.TargetPath; Args = $sc.Arguments }
    } | Where-Object { $_.Target -match 'conhost|cmd\.exe' -or $_.Arguments -match 'start ' }

The documented hijack rewrites the target to conhost.exe --headless cmd.exe /c start,
launching the real browser and the payload together.

N8. Web gateway hunt for the DOUBLECUP session protocol

The loader's server-side protocol is consistent across campaigns regardless of the
lure domain, which makes it a durable proxy-log hunt:

  URI path ends with   /api/config          (campaign configuration fetch)
  URI path contains    /session/reg         (session registration)
  URI path contains    /session/check       (readiness and completion polling, 1.2 to 3s)
  URI path contains    /session/signal      (infection confirmation)
  URI path contains    /stego-image.png?sid=

Highest-fidelity composite: the same client hitting /api/config and then polling a
/session/check endpoint on the same host more than 10 times inside 60 seconds.
That polling cadence is the loader waiting for the stego image to be ready and has
no benign equivalent.

On time windows. None of these queries carry an in-query timeframe filter. In CQL the right side of a comparison must be a literal, so @timestamp >= (now() - 7d) does not parse and silently breaks every query it leads. Set the window in the Falcon console instead. Last 7 days is a sensible default for the behavioral queries and Last 30 days for the infrastructure ones.

// HUNT: DOUBLECUP ClickFix, shell carving a payload out of the browser cache
// MITRE: T1204.004, T1027.003, T1083 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 (Windows)
// FALSE POSITIVES: none expected. A size-matched cache-file loop piped into an interpreter has no benign analogue.
// NOTE: set the search window in the console. Last 7 days is a good starting point.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/%~z/i
| CommandLine=/(findstr|certutil)/i
| CommandLine=/(AppData|User Data|Cache)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

// HUNT: Wildcard-obfuscated PowerShell resolution (DOUBLECUP stage 1 uses pow?r?hell.exe)
// MITRE: T1027, T1059.001 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 (Windows)
// FALSE POSITIVES: rare. The exclusion below removes the literal spelling so only obfuscated forms remain.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/pow[-a-z?*]{0,3}r[-a-z?*]{0,3}hell/i
| CommandLine!=/powershell/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

// HUNT: conhost --headless launched from a RENAMED copy (CountLoader 4.5p PE-patched LOLBin)
// MITRE: T1036.003, T1059.003 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 (Windows)
// FALSE POSITIVES: Windows Terminal uses --headless, but always as conhost.exe, which the exclusion removes.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/--headless/i
| FileName!=/^conhost(\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, SHA256HashData, CommandLine])

// HUNT: PowerShell download cradle with execution-policy bypass (CountLoader task re-fetch)
// MITRE: T1059.001, T1105 | CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 (Windows)
// FALSE POSITIVES: Chocolatey and Scoop bootstraps, some vendor installers, CI agents.
// TUNING: exclude your build and deployment service accounts by UserName, and exclude the
// TUNING: ParentBaseFileName of your approved software-distribution agent. Do NOT exclude on a
// TUNING: CommandLine substring alone, since that is the field the attacker controls.
// TUNING: an infected host repeats this roughly every 25 minutes. Sort by aid and look for cadence.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/-e[a-z]*p[a-z]*\s+bypass/i
| CommandLine=/(\birm\b|Invoke-RestMethod|\biwr\b|Invoke-WebRequest)/i
| CommandLine=/(\biex\b|Invoke-Expression)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

// HUNT: Impostor update tasks (CountLoader GoogleUpdateService / MSEdgeUpdateService,
//       DeviceManager MicroUpdaterV1 / PythonAppUpdater)
// MITRE: T1053.005 | CONF: high  FP: low  COST: low
// REQUIRES: ScheduledTaskRegistered (Windows)
// FALSE POSITIVES: none. Genuine vendor tasks are GoogleUpdateTaskMachine* and
// MicrosoftEdgeUpdateTaskMachine*, neither of which matches this start-anchored pattern.
#event_simpleName=/^ScheduledTaskRegistered$/
| TaskName=/^(GoogleUpdateService|MSEdgeUpdateService|MicroUpdaterV1|PythonAppUpdater|DOUBLECUP)/i
| table([@timestamp, aid, ComputerName, UserName, TaskName, TaskExecutable, TaskAuthor])

// HUNT: schtasks registering a task from an XML file staged in a user-writable path
// MITRE: T1053.005 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 (Windows)
// FALSE POSITIVES: vendor installers and MDM/RMM agents register tasks from an XML template.
// TUNING: exclude the ParentBaseFileName of your MDM/RMM agent and msiexec.exe where the parent
// TUNING: chain is signed. Anything left whose parent is a script interpreter is worth reading.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^schtasks(\.exe)?$/i
| CommandLine=/\bXML\b/i
| CommandLine=/(Temp|AppData|Users)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, CommandLine])

// HUNT: DeviceManager DNS-tunnel query structure (op prefix + device_hash + payload label)
// MITRE: T1071.004, T1041 | CONF: high  FP: low  COST: medium
// REQUIRES: DnsRequest (Windows/macOS)
// FALSE POSITIVES: very low. A single op letter, then a 16+ character hex hash, then an encoded label.
// NOTE: the malware appends a microsoft.com apex on purpose. Do not filter on the apex, filter on shape.
#event_simpleName=/^DnsRequest$/
| DomainName=/^[itr]-[0-9a-f]{16,64}-/i
| table([@timestamp, aid, ComputerName, DomainName, RequestType, ContextBaseFileName, ContextProcessId])

// HUNT: DNS tunnelling volumetrics, hosts emitting many maximum-length labels
// MITRE: T1071.004 | CONF: medium  FP: medium  COST: high
// REQUIRES: DnsRequest (Windows/macOS)
// FALSE POSITIVES: CDN, EDR and AV cloud-lookup traffic, and some telemetry SDKs, use long hashed labels.
// TUNING: exclude ContextBaseFileName for your AV/EDR agent and for browser processes FIRST, then
// TUNING: baseline the remaining top talkers for a week before you alert on anything.
// TUNING: raise the Lookups threshold to fit your estate. 100 suits a quiet corporate endpoint.
#event_simpleName=/^DnsRequest$/
| DomainName=/^[-a-z0-9]{45,63}\./i
| groupBy([aid, ComputerName, ContextBaseFileName], function=count(as=Lookups), limit=2000)
| Lookups > 100
| sort(Lookups, order=desc, limit=200)

// HUNT: DeviceManager Python entry points (run.pyw, agent_main.pyw, _dm_ temp task files)
// MITRE: T1059.006, T1620 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 (Windows)
// FALSE POSITIVES: none expected. These script names are specific to DeviceManager.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(run\.pyw|agent_main\.pyw|_dm_task\.py|_dm_[a-z0-9]{4,}\.(ps1|bat))/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine])

// HUNT: CountLoader wallet, browser-extension and Signal Desktop profiling strings
// MITRE: T1518.001, T1083, T1082 | CONF: medium  FP: low  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 (Windows)
// FALSE POSITIVES: low. Genuine wallet use does not pass these directory names as arguments.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(Ledger Live|Ledger Wallet|BitBox02|KeepKey|@trezor|Exodus|Guarda)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

// HUNT: Portable embeddable Python package pulled into a user profile (CountLoader taskType 11)
// MITRE: T1105, T1059.006 | CONF: medium  FP: low  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 (Windows)
// FALSE POSITIVES: developer workstations legitimately fetch embeddable Python. Scope to
// non-developer OUs first, or join against your developer host group and invert.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/python-3\.[0-9]{1,2}\.[0-9]{1,2}-embed-(amd64|win32)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

// HUNT: mshta.exe executing a remote URL (CountLoader command 10, proxied script execution)
// MITRE: T1218.005, T1105 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 (Windows)
// FALSE POSITIVES: rare in a managed estate. Legacy apps use LOCAL .hta files, not remote URLs.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^mshta(\.exe)?$/i
| CommandLine=/http[s]?:/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, CommandLine])

// HUNT: Outbound connection to published DOUBLECUP / DeviceManager infrastructure
// MITRE: T1071.001, T1102.001 | CONF: high  FP: low  COST: low
// REQUIRES: NetworkConnectIP4 (Windows/macOS)
// FALSE POSITIVES: none. Any hit is a confirmed infrastructure callback. Escalate, do not triage.
// NOTE: set the console window as wide as retention allows. This is the retro-hunt.
#event_simpleName=/^NetworkConnectIP4$/
| RemoteAddressIP4=/^(213\.139\.77\.109|91\.92\.240\.100|67\.219\.107\.181|80\.96\.109\.229|167\.148\.201\.131|89\.124\.117\.12|103\.22\.137\.227|146\.70\.124\.154)$/
| table([@timestamp, aid, ComputerName, ContextBaseFileName, LocalAddressIP4, RemoteAddressIP4, RemotePort])

// HUNT: DNS resolution of DOUBLECUP lure, staging and CountLoader C2 domains
// MITRE: T1071.001, T1583.001 | CONF: high  FP: low  COST: low
// REQUIRES: DnsRequest (Windows/macOS)
// FALSE POSITIVES: none. These are dedicated actor domains, not compromised legitimate sites.
// NOTE: pair a hit here with Q1 on the same aid to establish whether the user actually executed.
#event_simpleName=/^DnsRequest$/
| DomainName=/(^|\.)(login-netsuite\.com|login-odoo\.com|login-salesforce\.com|verification-salesforce\.com|login-hubspot\.com|pending-verification\.com|doublecap\.ltd|doublecap\.live|canva-arts\.com|cloudscraft\.com|examcanvas\.com|storagepioneer\.com|supercloudsaver\.com|ticgo-cloud\.com|roqqcloud\.com|cloud-electronic\.com|nxtdrcliam\.site|alphastore\.vg|appleid-customertelemetry\.gl|spec-connectweb3\.tv|srv641398444\.host\.ultaserver\.net)$/i
| table([@timestamp, aid, ComputerName, DomainName, ContextBaseFileName, ContextProcessId])

// HUNT: macOS CountLoader reconnaissance burst (sw_vers, system_profiler, ioreg, launchctl)
// MITRE: T1082, T1543.001, T1059.004 | CONF: medium  FP: medium  COST: medium
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 (macOS sensor coverage required)
// FALSE POSITIVES: MDM, inventory and patch agents call the same utilities on a schedule.
// TUNING: exclude the ParentBaseFileName of your MDM and inventory agents first, for example
// TUNING: jamf, munki or osqueryd, then review any remaining parent that is not a signed managed
// TUNING: binary. A parent living in a user home directory or in Downloads is the finding.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(sw_vers|system_profiler|ioreg|launchctl)$/i
| groupBy([aid, ComputerName, ParentBaseFileName], function=count(as=Hits), limit=2000)
| Hits >= 3
| sort(Hits, order=desc, limit=200)

// HUNT: Inno Setup stager unpacking with the /SL5 IPC flag from a download or temp path
// MITRE: T1204.002, T1027 | CONF: medium  FP: high  COST: medium
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 (Windows)
// FALSE POSITIVES: HIGH BY DESIGN. Every Inno Setup installer uses this flag. Not an alert.
// TUNING: run this ONLY scoped to an aid already flagged by Q9 or Q13, or restricted to hosts
// TUNING: with no software-install change ticket for the period.
// TUNING: exclude the SHA256HashData values of the Inno-packaged software you deploy, then review
// TUNING: whatever remains. Do not promote this query to a scheduled search.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/SL5=/i
| CommandLine=/(Downloads|Temp|AppData)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, SHA256HashData, CommandLine])

Four of the sixteen queries are clean enough to promote to Custom IOAs. The rest stay as Investigate-only hunts. Deploy every IOA in Detect for two weeks before considering Prevent, and note that Q3 is the only one where an immediate Prevent action is genuinely low-risk.

Investigate-only (do not promote)

• Q4, Q6, Q8, Q15, Q16. All carry FP medium or higher. Each has a // TUNING: block inside the query card. Baseline them in your own estate before they earn an alert.
• Q13 and Q14 are better served by Falcon IOC Management using the CSV in section 10 than by a Custom IOA, because IOC Management handles expiry and bulk revocation for you.
• Q16 specifically must not become a scheduled search. Every Inno Setup installer matches it.

Deployment path: Falcon console, Endpoint security, Custom IOA rule groups. Create one Windows rule group named for this campaign and one macOS group, assign to a pilot host group of roughly 50 endpoints, then review for a week before widening. Custom IOAs evaluate on every matching event, so keep the regex anchored as written rather than loosening it.

Four one-click blocks. The CSV imports directly into Falcon IOC Management. The behavioral block is what still works after the operator rotates infrastructure, which for DeviceManager takes one blockchain transaction.

type,value,action,severity,expiration,description,tags
sha256,882914f9014f14e89123e835f103ac8f9d4b2e358c1f21c1cbc7f1054e6afed6,prevent,critical,2027-02-05,DOUBLECUP Go operator client,campaign:DOUBLECUP
sha256,8585721cbc46780903bd727e37a9ed07a33463852046ff65bc718ded4c80dfb1,prevent,critical,2027-02-05,DOUBLECUP Go operator client,campaign:DOUBLECUP
sha256,28cbbca8099bb1b27668d135314842c69ceb478a7d6b4b08f063d106a06c8f9d,detect,high,2027-02-05,DOUBLECUP stage 2 steganographic PNG,campaign:DOUBLECUP
sha256,6e08cb5602f63bee2b40739167b4aef77763bc8fb47b4839ca2fc1607ad35cba,prevent,critical,2027-02-05,MicroUpdaterV1.exe DeviceManager Inno Setup stager,malware:DeviceManager
sha256,ea70895620f955b0712b85c3fee41de7437d5068267966f0b4fb6fa2704c3a50,prevent,critical,2027-02-05,run.pyw DeviceManager RAT core,malware:DeviceManager
sha256,bdf28e611d77362c40a0445655a35943c03accf21bb9a5af755da7eac5ea5e40,prevent,critical,2027-02-05,CountLoader 4.5p,malware:CountLoader
sha256,afe273533d6f9d0b8852988f6a4b34571dd52af4c690e54723a86257aa8a015d,prevent,critical,2027-02-05,setup.sh macOS CountLoader stager,malware:CountLoader
sha256,08730fda7366104b1461b12834f55723381bf34a234947689c708b1ee431af69,prevent,critical,2027-02-05,AppleIDVerificationService macOS CountLoader,malware:CountLoader
ipv4,213.139.77.109,detect,high,2026-11-05,DOUBLECUP license panel and open directory port 9090,campaign:DOUBLECUP
ipv4,91.92.240.100,detect,critical,2026-11-05,DeviceManager C2 resolved via EtherHiding,malware:DeviceManager
ipv4,67.219.107.181,detect,high,2026-11-05,DOUBLECUP payload builder callback host,campaign:DOUBLECUP
ipv4,80.96.109.229,detect,medium,2026-11-05,DOUBLECUP license panel activity,campaign:DOUBLECUP
ipv4,167.148.201.131,detect,medium,2026-11-05,DOUBLECUP license panel activity,campaign:DOUBLECUP
ipv4,89.124.117.12,detect,medium,2026-11-05,DOUBLECUP license panel activity,campaign:DOUBLECUP
ipv4,103.22.137.227,detect,medium,2026-11-05,DOUBLECUP server activity,campaign:DOUBLECUP
ipv4,146.70.124.154,detect,medium,2026-11-05,DOUBLECUP server activity,campaign:DOUBLECUP
domain,login-netsuite.com,prevent,high,2026-11-05,CRM lure page injecting DOUBLECUP,campaign:DOUBLECUP
domain,login-odoo.com,prevent,high,2026-11-05,CRM lure page injecting DOUBLECUP,campaign:DOUBLECUP
domain,login-salesforce.com,prevent,high,2026-11-05,CRM lure page injecting DOUBLECUP,campaign:DOUBLECUP
domain,verification-salesforce.com,prevent,high,2026-11-05,CRM lure page injecting DOUBLECUP,campaign:DOUBLECUP
domain,login-hubspot.com,prevent,high,2026-11-05,CRM lure page injecting DOUBLECUP,campaign:DOUBLECUP
domain,pending-verification.com,prevent,high,2026-11-05,CRM lure page injecting DOUBLECUP,campaign:DOUBLECUP
domain,doublecap.ltd,prevent,high,2026-11-05,Delivers DOUBLECUP,campaign:DOUBLECUP
domain,doublecap.live,prevent,high,2026-11-05,Delivers DOUBLECUP,campaign:DOUBLECUP
domain,canva-arts.com,prevent,high,2026-11-05,Delivers DOUBLECUP,campaign:DOUBLECUP
domain,cloudscraft.com,prevent,high,2026-11-05,Delivers DOUBLECUP,campaign:DOUBLECUP
domain,examcanvas.com,prevent,high,2026-11-05,Delivers DOUBLECUP,campaign:DOUBLECUP
domain,storagepioneer.com,prevent,high,2026-11-05,Delivers DOUBLECUP,campaign:DOUBLECUP
domain,supercloudsaver.com,prevent,high,2026-11-05,Delivers DOUBLECUP,campaign:DOUBLECUP
domain,ticgo-cloud.com,prevent,high,2026-11-05,Delivers DOUBLECUP,campaign:DOUBLECUP
domain,roqqcloud.com,prevent,high,2026-11-05,Delivers DOUBLECUP,campaign:DOUBLECUP
domain,cloud-electronic.com,prevent,high,2026-11-05,Delivers DOUBLECUP,campaign:DOUBLECUP
domain,cap.spec-connectweb3.tv,prevent,high,2026-11-05,Delivers DOUBLECUP,campaign:DOUBLECUP
domain,cap-t1.spec-connectweb3.tv,prevent,high,2026-11-05,Delivers DOUBLECUP,campaign:DOUBLECUP
domain,cap-t2.spec-connectweb3.tv,prevent,high,2026-11-05,Delivers DOUBLECUP,campaign:DOUBLECUP
domain,nxtdrcliam.site,prevent,high,2026-11-05,Hosts DOUBLECUP server component,campaign:DOUBLECUP
domain,srv641398444.host.ultaserver.net,prevent,high,2026-11-05,Hosts DOUBLECUP server. FQDN only. Do not block the provider apex,campaign:DOUBLECUP
domain,alphastore.vg,prevent,high,2026-11-05,Delivers DOUBLECUP and CountLoader C2,malware:CountLoader
domain,appleid-customertelemetry.gl,prevent,high,2026-11-05,macOS CountLoader C2 and stager host,malware:CountLoader
url,http://67.219.107.181/hgflssvslvidfugvbldiuv,detect,high,2026-11-05,DOUBLECUP payload builder callback URL,campaign:DOUBLECUP
url,https://appleid-customertelemetry.gl/setup.sh,prevent,high,2026-11-05,macOS CountLoader stager,malware:CountLoader
url,https://appleid-customertelemetry.gl/AppleIDVerificationService,prevent,high,2026-11-05,macOS CountLoader Mach-O,malware:CountLoader
url,https://s3.us2.lyve.seagate.com/fullstack09/MicroUpdaterV1.exe,detect,high,2026-11-05,DeviceManager staged on abused Seagate Lyve storage. Full object path only. NEVER block the seagate apex,malware:DeviceManager
# Not importable into Falcon IOC Management. Monitor externally, see the Web3 block.
# smart contract 0xc027490AF56a9d7050fc259Ecd03DA1580b84aae
# operator address 0xCE17b1EF00d47105Bc127BbE6fC45dE47BC22fb8

These do not expire and cannot be rotated by the operator. Prefer them over the CSV.

DELIVERY
  shell reads a browser cache file selected by EXACT byte size, then carves it
    markers: %~z size comparison, findstr or certutil, a browser User Data path
  PowerShell reached through a glob rather than by name  (pow?r?hell.exe)
  clipboard write immediately followed by a Run-dialog process launch

COUNTLOADER 4.5p
  a process invoked with --headless whose filename is NOT conhost.exe
  copies of conhost.exe / powershell.exe / mshta.exe outside System32 whose PE
    OriginalFilename or InternalName does not match the on-disk filename
  single-letter-prefixed system binary names in a user-writable path
    pattern: c* for conhost, p* for powershell, m* for mshta  (e.g. csvchost.exe)
  scheduled task with WakeToRun enabled AND a repetition interval under 30 minutes
  HTTP GET to /connect? where the query string is hex with a 6-digit prefix
  process alive for only a few seconds, repeating on a fixed 25-minute cadence

DEVICEMANAGER
  pythonw.exe running from a user-writable path with no installed Python product
  DNS query whose first label is  <op-letter>-<16-char hex>-<payload>
  sustained DNS TXT queries with 63-character labels from a single host
  WMI __FilterToConsumerBinding created with NO wmic.exe or powershell.exe ancestor
  cmd.exe /Q /K or powershell.exe -Command - fed entirely over STDIN
  eth_call traffic to public Web3 RPC nodes from a host with no blockchain workload

MACOS COUNTLOADER
  LaunchAgent plist referencing a binary in ~/Library, /tmp or Downloads
  burst of sw_vers + system_profiler + ioreg under one non-managed parent

SCHEDULED TASK NAMES
  GoogleUpdateService<GUID>      CountLoader primary,  25 min, WakeToRun
  MSEdgeUpdateService<GUID>      CountLoader fallback, 25 min
  MicroUpdaterV1                 DeviceManager primary, 10 min
  PythonAppUpdater               DeviceManager fallback
  DOUBLECUP                      operator-side client tooling
  (genuine vendor tasks are GoogleUpdateTaskMachine* and
   MicrosoftEdgeUpdateTaskMachine*, so match the full prefix)

WMI SUBSCRIPTION OBJECTS  (root\subscription)
  __EventFilter                  PythonAppUpdateFilter
  CommandLineEventConsumer       PythonAppUpdateConsumer
  __IntervalTimerInstruction     PythonAppTimer_600      (600000 ms)

FILE PATHS
  %LOCALAPPDATA%\DeviceManager\config.json        AgentConfig, contract + key
  %LOCALAPPDATA%\DeviceManager\agent.log          rotating log, best forensic source
  %LOCALAPPDATA%\DeviceManager\agent_main.pyw     hidden entry point
  %LOCALAPPDATA%\DeviceManager\agent\             full package copy
  %TEMP%\t.xml                                    task XML, deleted immediately
  %TEMP%\_dm_task.py                              in-memory python task wrapper
  %TEMP%\_dm_<random>.ps1                         on-disk powershell task
  %TEMP%\_dm_<random>.bat                         on-disk cmd task
  %USERPROFILE%\App_<GUID>.py                     CountLoader masquerading helper
  %USERPROFILE%\Python313\                        embeddable Python 3.13 staging
  ~/Library/LaunchAgents/*.plist                  macOS CountLoader persistence

FILE NAMES AND STRINGS
  MicroUpdaterV1.exe        run.pyw          agent_main.pyw
  App.py                    is-*.tmp         python-3.13.13-embed-amd64.zip
  AppleIDVerificationService                 setup.sh
  K94DGQ99VYCCH52TKOT2      hardcoded CountLoader campaign token
  ZZ1984                    findstr needle in the reference stego PNG

C2 URI PATTERNS
  /api/config    /session/reg    /session/check    /session/signal
  /stego-image.png?sid=          /connect?         approveUpdate?id=
  getUpdates     (POST body, XOR+hex encoded, Bearer JWT)

ACTOR HANDLES  (pivot only, not detection)
  Telegram bot  @harrypoterlohBOT
  Actor         Rognar / @johnysilverhe   (primary source spelling, single n)
  Also seen as  johnnysilverhe            (double n, as VS Code publisher)
  VS Code ext   Agent IDE

DeviceManager reads its live C2 from a smart contract, so the operator re-points the
entire botnet with ONE transaction and no implant redeployment. That makes contract
monitoring the only way to get the next C2 BEFORE it is used against you.

CONTRACT
  0xc027490AF56a9d7050fc259Ecd03DA1580b84aae     C2 resolver contract
  0xCE17b1EF00d47105Bc127BbE6fC45dE47BC22fb8     operator address writing updates
  networks: Ethereum / Polygon. The analysed sample pointed at Sepolia testnet RPCs.

FUNCTION SELECTORS
  0x1dcf296b   read.   Called with the victim device_hash. Returns a per-victim C2.
  0xc474520d   write.  GLOBAL C2 update. A call here re-points the whole botnet.
  0x71c28139   write.  Targeted C2 assignment to one specific infected device.

WHAT TO DO WITH IT
  1. Set a block-explorer alert on any transaction to the contract address above.
  2. On a 0xc474520d call, pull the calldata, strip the 0x prefix, read the ABI
     offset and length, then ChaCha20-decrypt the payload. The key is the SHA-256 of
     the campaign blockchain_key and the nonce is derived from the contract address.
  3. First decrypted byte 0x00 means the new C2 is HTTP POST, anything else means
     DNS tunnelling. The remainder is UTF-8 and is the IP or hostname. If no port is
     present the malware appends :53 for DNS or :80 for HTTP.
  4. Push the recovered address into the CSV block above as a new detect entry.

The known-good decryption of the most recent global-update transaction at the time of
the source report resolved to:   dns://91.92.240[.]100

ENDPOINT-SIDE SIGNAL (no contract access needed)
  Alert on eth_call JSON-RPC traffic, or DNS/TLS to public Web3 RPC providers, from
  any host outside your developer and treasury groups. Build that allowlist first,
  because the exclusion list is the detection here.

Work these four gates in order. Do not promote anything to Prevent until gate 4 passes, and record the date each gate cleared so the coverage claim in section 15 is evidenced rather than assumed.

Gate 1 — Telemetry ready

• Confirm ProcessRollup2 volume is non-zero per host per day across the Windows estate. If command lines are truncated or suppressed by policy, Q1 through Q6 and Q9 through Q12 are all degraded and you must fix that before continuing.
• Confirm ScheduledTaskRegistered events exist at all. Several tenants have this event class disabled or filtered, which silently kills Q5.
• Confirm DnsRequest is present and that endpoints actually use the internal resolver. If a host talks to an external resolver directly, Q7 and Q8 will never see its tunnel traffic.
• Confirm macOS sensor coverage separately. Q15 assumes macOS process telemetry, which is commonly a lower deployment percentage than Windows.

Gate 2 — Benign baseline

• Run Q4, Q6, Q8, Q15 and Q16 over 14 days with no exclusions. Record the hit count and the top ten parents or accounts for each.
• Write the exclusions named in each card's // TUNING: block against what you actually saw, not against what the card guessed. The tuning lines are a starting hypothesis about your estate, not a fact about it.
• Expected steady state after tuning: Q4 in the low tens per week in an estate that uses package managers, and near zero in one that does not. Q8 should settle to a stable set of the same few agent processes, which you then exclude.
• Q1, Q3, Q5, Q7, Q9 and Q13 should all baseline at zero. Any non-zero result during baselining is a finding, not noise. Investigate before excluding anything.

Gate 3 — Positive tests

Run these on an isolated, instrumented test host. They exercise the detection logic without executing anything malicious and without reproducing any part of the attack chain.

Q3   copy conhost.exe to a user path under a different name and launch it with
     --headless and a trivial argument. Confirm the query fires on the renamed image.
     This is the highest-value test because it validates the masquerade logic itself.

Q5   register a scheduled task literally named MSEdgeUpdateServiceTEST pointing at
     a harmless executable. Confirm Q5 fires, then delete the task.

Q7   from the test host, resolve a hostname of the shape
     i-0123456789abcdef-test.example.com  against your internal resolver.
     Confirm the DnsRequest event appears and Q7 matches the label shape.

Q9   create an empty file named run.pyw and invoke it through a python interpreter.
     Confirm the command line is captured.

Q12  run  mshta.exe https://example.com/  and confirm it fires. Kill it immediately.

Q13  no safe positive test exists. Validate by confirming the query parses and by
     checking it returns rows when you temporarily substitute a benign IP you control.

Detection latency target: all of the above should surface within 5 minutes.
If they do not, the problem is telemetry ingestion, not the query.

Gate 4 — Promotion

• Promote Q1, Q3, Q5 and Q7 to Custom IOAs in Detect only. Hold for 14 days.
• Move Q3 to Prevent first. It has the cleanest logic and the least plausible benign match.
• Move Q1 to Prevent once you are satisfied gate 2 held at zero. A true positive on Q1 means the host is already running attacker-supplied code, so blocking is the correct outcome.
• Leave Q5 and Q7 in Detect indefinitely. Both are worth alerting on and neither is worth blocking, because by the time they fire the payload has already run.
• Import the section 10 CSV into Falcon IOC Management with the expiry dates as written, then diary a review for 2026-11-05 when the network indicators lapse.

DOUBLECUP is unusually vulnerable to prevention because its delivery depends on two things a managed estate does not actually need: an interactive Run dialog and a web page's ability to write to the clipboard. Take those away and the loader has no route from a lure page to a shell. Everything else here is depth behind that.

Raw configuration for the four highest-leverage controls. Every step carries its prerequisites, whether a reboot is needed, and how to undo it. Test each on a pilot ring before estate-wide rollout.

Playbook 1 — Remove the ClickFix paste target (HRD-1, HRD-2)

STEP 1.1  Remove the Run dialog for standard users
  Prerequisites:    GPO edit rights. A pilot OU. Confirm no line-of-business process
                    instructs users to launch anything via Win+R, and confirm your
                    help-desk scripts do not rely on it for standard users.
  Reboot required:  No. Applies at next Group Policy refresh or user logon.

  GPO path: User Configuration \ Policies \ Administrative Templates \
            Start Menu and Taskbar \ "Remove Run menu from Start Menu"  =  Enabled

  Registry equivalent (per user hive):
    Key:   HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
    Value: NoRun    Type: REG_DWORD    Data: 1

  Verify:
    gpresult /h report.html      then search the report for "Remove Run menu"
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun

  Note: this removes the Start Menu entry and disables the Win+R shortcut. It does not
  block cmd.exe or PowerShell themselves, which remain available to administrators.

  Rollback:  Set the GPO setting to "Not Configured" (do NOT set it to Disabled, which
             writes NoRun=0 and pins the behaviour on). Then delete the value:
               reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /f
             Effective at next policy refresh. No reboot.

STEP 1.2  Block the browser clipboard-write permission
  Prerequisites:    Chrome or Edge enterprise policy management (ADMX ingested, or
                    Intune / Workspace policy). Inventory any internal web app that
                    legitimately uses a "copy to clipboard" button, because those need
                    an allowlist entry BEFORE this goes on.
  Reboot required:  No. Browser restart required.

  Chrome:
    Key:   HKLM\SOFTWARE\Policies\Google\Chrome
    Value: DefaultClipboardSetting    Type: REG_DWORD    Data: 2

  Edge:
    Key:   HKLM\SOFTWARE\Policies\Microsoft\Edge
    Value: DefaultClipboardSetting    Type: REG_DWORD    Data: 2

  Value meanings:  2 = do not allow any site to use the clipboard site permission
                   3 = ask the user (this is the default when the policy is unset)

  Allowlist for internal apps that genuinely need it:
    Chrome: HKLM\SOFTWARE\Policies\Google\Chrome\ClipboardAllowedForUrls\1 = "https://intranet.example.com"

  Verify:  browse to chrome://policy or edge://policy and confirm the value is applied
           and shows no conflict.

  IMPORTANT: confirm the exact registry path in your own browser-management console
  before mass deployment. The policy NAME and its value semantics are vendor-confirmed;
  the registry path in this playbook was not read from a rendered vendor page in the
  research for this pack, so treat it as needing a one-host verification first.

  Limitation: this blocks programmatic clipboard writes. It does not prevent a user
  manually selecting text on the page and copying it, so pair it with HRD-1 and HRD-18.

  Rollback:  Delete the DefaultClipboardSetting value (or set it to 3) and restart the
             browser. Effect is immediate on restart.
               reg delete "HKLM\SOFTWARE\Policies\Google\Chrome" /v DefaultClipboardSetting /f

Playbook 2 — ASR rules that break both payloads (HRD-3, HRD-4, HRD-6, HRD-11, HRD-12)

STEP 2.1  Enable in AUDIT mode first
  Prerequisites:    Microsoft Defender Antivirus active (not passive). Cloud-delivered
                    protection ON, which the obfuscated-script rule requires. If you run
                    Configuration Manager, read the warning in step 2.3 before enabling
                    the PSExec/WMI rule anywhere.
  Reboot required:  No.

  Add-MpPreference -AttackSurfaceReductionRules_Ids c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb `
                   -AttackSurfaceReductionRules_Actions AuditMode   # copied/impersonated system tools
  Add-MpPreference -AttackSurfaceReductionRules_Ids e6db77e5-3df2-4cf1-b95a-636979351e5b `
                   -AttackSurfaceReductionRules_Actions AuditMode   # WMI event subscription persistence
  Add-MpPreference -AttackSurfaceReductionRules_Ids 5beb7efe-fd9a-4556-801d-275e5ffc04cc `
                   -AttackSurfaceReductionRules_Actions AuditMode   # obfuscated scripts
  Add-MpPreference -AttackSurfaceReductionRules_Ids d3e037e1-3eb8-44c8-a917-57927947596d `
                   -AttackSurfaceReductionRules_Actions AuditMode   # JS/VBS launching downloaded content
  Add-MpPreference -AttackSurfaceReductionRules_Ids b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 `
                   -AttackSurfaceReductionRules_Actions AuditMode   # untrusted processes from USB

  Verify:
    (Get-MpPreference).AttackSurfaceReductionRules_Ids
    (Get-MpPreference).AttackSurfaceReductionRules_Actions
    Audit events: Microsoft-Windows-Windows Defender/Operational, EID 1121 and 1122

  Rollback:  Remove-MpPreference -AttackSurfaceReductionRules_Ids <guid>
             Immediate, no reboot.

STEP 2.2  Review audit output, then move to Block
  Prerequisites:    At least 7 days of audit data covering a full business cycle,
                    including a patch window and a month-end if you have one.
  Reboot required:  No.

  Review EID 1121/1122 per rule. Expect near-zero for the copied-system-tools and
  WMI-subscription rules in a healthy estate. If either is noisy, that noise IS the
  finding and needs investigating before you exclude it.

  Then flip each reviewed rule:
    Set-MpPreference -AttackSurfaceReductionRules_Ids c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb `
                     -AttackSurfaceReductionRules_Actions Enabled

  Exclusions, only where a business case is documented:
    Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Program Files\Vendor\app.exe"
  Note these rules have LIMITED exclusion support per Microsoft, so a path exclusion
  may not behave as you expect. Verify each one.

  Rollback:  Set the rule action back to AuditMode, or remove the rule ID entirely.
             Immediate, no reboot.

STEP 2.3  mshta and the PSExec/WMI rule
  Prerequisites:    Confirm no line-of-business application depends on mshta.exe. Search
                    ProcessRollup2 for mshta parents over 30 days before deciding.
                    CRITICAL: if you use Microsoft Configuration Manager, Microsoft
                    advises against enabling the PSExec/WMI rule through any other
                    deployment method, because the ConfigMgr client depends heavily on
                    WMI. Test extensively in Audit first.
  Reboot required:  No.

    Add-MpPreference -AttackSurfaceReductionRules_Ids d1e49aac-8f56-4280-b9ba-993a6d77406c `
                     -AttackSurfaceReductionRules_Actions AuditMode

  Rollback:  Remove-MpPreference -AttackSurfaceReductionRules_Ids d1e49aac-8f56-4280-b9ba-993a6d77406c
             Immediate, no reboot. If ConfigMgr breaks, this is the first thing to undo.

Playbook 3 — PowerShell visibility and scheduled-task auditing (HRD-5, HRD-9)

STEP 3.1  Script-block logging, module logging, transcription
  Prerequisites:    Log storage sized for the increase. Script-block logging is verbose,
                    typically the largest single Windows log volume increase you will
                    make. Confirm your SIEM licence covers it before enabling fleet-wide.
  Reboot required:  No. Applies to new PowerShell sessions.

  GPO path: Computer Configuration \ Policies \ Administrative Templates \
            Windows Components \ Windows PowerShell
    "Turn on PowerShell Script Block Logging"  = Enabled
        (leave "Log script block invocation start/stop" OFF, it multiplies volume
         for very little investigative gain)
    "Turn on Module Logging"                   = Enabled, module names = *
    "Turn on PowerShell Transcription"         = Enabled
        OutputDirectory = a write-only share the user cannot read or delete from,
        otherwise the malware simply removes its own transcript.

  Registry equivalent:
    HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
      EnableScriptBlockLogging  REG_DWORD  1
    HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription
      EnableTranscripting       REG_DWORD  1

  Verify:  run a trivial command, then confirm EID 4104 appears in
           Microsoft-Windows-PowerShell/Operational.

  Rollback:  Set each policy to "Not Configured" and delete the registry values.
             Applies to new sessions. No reboot.
               reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /f

STEP 3.2  Scheduled task creation auditing
  Prerequisites:    Advanced audit policy in use (not legacy audit policy). Log storage
                    headroom, though this event is low volume.
  Reboot required:  No.

    auditpol /set /subcategory:"Other Object Access Events" /success:enable /failure:enable

  GPO equivalent: Computer Configuration \ Policies \ Windows Settings \ Security Settings \
                  Advanced Audit Policy Configuration \ Object Access \
                  "Audit Other Object Access Events"  = Success and Failure

  Verify:
    auditpol /get /subcategory:"Other Object Access Events"
    Create a test task and confirm Security EID 4698 is written.

  Rollback:  auditpol /set /subcategory:"Other Object Access Events" /success:disable /failure:disable
             Immediate, no reboot.

Playbook 4 — DNS containment for the tunnel (HRD-7)

STEP 4.1  Force internal resolvers and block external DNS
  Prerequisites:    Internal resolvers sized for full estate query load with logging on.
                    Inventory anything that hardcodes an external resolver: some IoT,
                    some VPN clients, some container runtimes. Those break first.
  Reboot required:  No, but endpoints may need a DHCP lease renewal or a network
                    profile refresh to pick up the resolver change.

  Firewall rule (egress, applied at the perimeter and on the host firewall):
    DENY   any internal source -> any external destination, UDP 53
    DENY   any internal source -> any external destination, TCP 53
    DENY   any internal source -> any external destination, TCP 853  (DoT)
    ALLOW  approved resolvers  -> upstream, UDP/TCP 53

  Also block DNS-over-HTTPS bypass in browser policy, otherwise the browser routes
  around your resolver and the endpoint DNS logs go quiet:
    Chrome / Edge:  DnsOverHttpsMode = "off"
      HKLM\SOFTWARE\Policies\Google\Chrome\DnsOverHttpsMode      REG_SZ  off
      HKLM\SOFTWARE\Policies\Microsoft\Edge\DnsOverHttpsMode     REG_SZ  off

  Verify:
    From a test endpoint, query any EXTERNAL resolver directly, for example
      nslookup example.com 192.0.2.53      (this must FAIL once the rule is live)
    Confirm queries appear in the internal resolver log with the client IP attributed.

  Rollback:  Remove the egress deny rules and set DnsOverHttpsMode back to
             "automatic" or delete the value. Immediate. No reboot.
             Keep resolver logging on even if you roll back the blocks, since the
             logging alone is what Q7 and Q8 depend on.

STEP 4.2  Alert on tunnelling shape
  Prerequisites:    Step 4.1 complete and resolver logs flowing to the SIEM with
                    per-client attribution and record type.
  Reboot required:  No.

  Resolver or SIEM rules:
    - any single client exceeding a per-hour TXT query threshold you baseline first
    - first label length at or near 63 characters, sustained
    - a client querying a microsoft.com subdomain that resolves to non-Microsoft space
      (this is the specific DeviceManager blend-in trick)
    - NXDOMAIN ratio per client above your baseline

  Rollback:  Disable or tune the alert rules. Detection only, no endpoint state changed,
             so there is nothing to undo on the fleet.

Rollback discipline. Every step above changes endpoint or network state and every one has a documented undo. The two with the widest blast radius are the PSExec/WMI ASR rule where Configuration Manager is in use, and the external-DNS block, which will surface every device that hardcodes a public resolver. Stage both on a pilot ring and keep the rollback command to hand during the change window.

Before you isolate, capture memory. CountLoader 4.5p deletes itself from disk on first execution and lives only in the scheduled task that re-fetches it. DeviceManager deletes its task XML and its temp task files immediately after use. If you isolate and reboot before acquiring memory, most of what you needed is gone. The scheduled task definitions and agent.log are the artifacts that survive.

Coverage summary. Sixteen queries cover sixteen of the twenty-two mapped behaviors, ten of them at good confidence with four promoted to Custom IOAs. Six behaviors are gaps. Five of those six are gaps by nature rather than by omission: reflective loading, environmental keying and ctypes API calls produce no distinct endpoint event in any EDR, and EtherHiding happens on a public blockchain rather than on your network. Each is addressed by a preventive control or a native audit-log hunt instead, and each is named as such rather than being quietly dropped. The one gap that is genuinely worth closing with better telemetry is WMI Event Subscription persistence, where the Windows WMI-Activity operational log carries the signal that the EDR does not.

Validation status. All four gates in section 11 are open at v0.1. Nothing in this pack has been baselined in a live estate, so the FP ratings are informed estimates, not measurements. Work gate 2 before you alert on Q4, Q6, Q8, Q15 or Q16, and note that Q1, Q3, Q5, Q7, Q9 and Q13 are all expected to baseline at zero, which makes any non-zero result during gate 2 a finding rather than noise.

Perishability note for the next revision. The DeviceManager C2 is resolved from a smart contract, so 91.92.240[.]100 can be replaced by the operator with a single blockchain transaction and no implant update. Re-check the contract before relying on that indicator. The network indicators are set to expire 2026-11-05. The behavioral queries Q1 through Q3, Q5, Q7 and Q9 carry no expiry because they describe technique, not infrastructure.

Source snapshots

Every source above was saved verbatim at research time so that each atomic indicator in this pack can be mechanically traced back to the text it came from. The snapshots ship alongside this file in DOUBLECUP-ClickFix-LaaS-Hunt-sources/:

• 01-socradar-doublecup-primary.txt
• 02-thehackernews-doublecup.txt
• 03-bleepingcomputer-doublecup.txt
• 04-microsoft-asr-rules-reference.txt
• 05-chrome-clipboard-policy.txt

Integrity note. All five fetched sources were screened for text addressed to an automated agent, such as instructions to run commands, to fetch a further URL because "the real indicators are there", or claims of prior authorisation. None was found and no source was dropped. The SOCRadar page initially returned HTTP 403 and then a bot-check interstitial. It was retrieved on a later attempt once the interstitial cleared on its own. No bot protection was solved or bypassed.