GoldenEyeDog / CylindricalCanine — DigiCert EV Code-Signing Certificate Theft

The attacker's objective was trust, not data. CylindricalCanine — a subgroup of the Chinese cybercrime group GoldenEyeDog (APT-Q-27 / Dragon Breath / Miuuti Group, active since at least 2015) — did not breach DigiCert to steal customer records. They breached it to obtain the ability to sign malware as somebody else.

On 2026-04-02 the actor opened a customer-support chat with DigiCert and delivered a ZIP disguised as a customer screenshot; inside was a .scr executable. Two support-analyst workstations were compromised. The actor then abused a legitimate support-portal function that lets an authenticated analyst view an account "as the customer," and used it to read EV Code Signing initialization codes for orders that were approved but not yet delivered. An initialization code plus an approved order was functionally sufficient to obtain the certificate. DigiCert revoked 60 fraudulently obtained certificates across four issuing CAs; 27 were explicitly tied to the actor.

The malware is a modular, heavily modified Gh0st RAT (the family also tracked as Farfli, and reported by ANY.RUN as "Zhong Stealer") which Expel names Golden Gh0st RAT, delivered by Golden Gh0st Loader. It carries plugins for browser credential theft, keylogging, screenshot capture, SOCKS/TCP proxying, shell execution, event-log wiping, and a plugin32.dll module that installs a hidden local admin account and an RDP backdoor. A sibling cluster inside GoldenEyeDog uses RONINGLOADER, which disables Defender via PPL abuse and a signed kernel driver before dropping the same Gh0st variant.

Why this pack leads with the downstream angle. Most organisations were not DigiCert support analysts. But every organisation runs software-allowlisting and reputation logic that says "signed by a valid DigiCert EV cert = trusted." That assumption is what was stolen. Since 2024, Expel's Cert Graveyard has catalogued 75 unique code-signing certificates used by this loader, and the published IOC set contains 1,925 signed files. The highest-value hunt in your environment is therefore not "did we get phished" — it is "is a validly signed binary doing something a validly signed binary should not do?"

Defender priority: a valid Authenticode signature is now an attribute, not a verdict. Rank signed-binary executions from user-writable paths, first-seen-rare signed images, and signed PEs with screenshot-style filenames (image2026041168.com) above unsigned equivalents in triage — the signature is exactly what the actor paid to acquire.

Web-hunter decisions

• Certificate serials were treated as first-class atomic IOCs. They come from the Expel expel-intel IOC CSV, not from prose, and are the only indicator class that survives recompilation of the payload.
• Signer organisations named in this pack are victims, not perpetrators. Their certificates were obtained fraudulently through DigiCert's support portal. Treat a match as "this cert is burned," never as "this vendor is malicious."
• Two legitimate Microsoft runtimes (vcruntime140.dll, msvcp140.dll) appear in the delivery bundle and were deliberately excluded from the IOC set — blocking them would be self-inflicted damage.
• secnews.gr was dropped. The fetch returned a bot-check interstitial with no article body; a source that cannot be snapshotted cannot back an indicator, so it is not cited.
• No certificate thumbprints were published, only serials. The pack does not invent them; thumbprint-based blocking is left as a labelled placeholder.

Hypotheses

1. H1 (highest value). A binary in our estate carries a valid Authenticode signature from a certificate in the burned set, or behaves like one: signed, rare, and running from a user-writable directory.
2. H2. A support / customer-facing / ticketing-adjacent user executed an archive attachment containing a .scr, .com or double-extension "screenshot," delivered via chat or a ticketing system rather than ordinary email.
3. H3. A legitimate signed EXE side-loaded a malicious DLL from the same directory, alongside an encrypted blob masquerading as .log.
4. H4. A host is beaconing plaintext WebSocket to a low-numbered port (5188 / 5198) or resolving the published C2 domains.
5. H5. RDP was silently enabled and a hidden local administrator created with automatic logon configured.
6. H6. Defender was neutered via service/driver abuse or PPL abuse (RONINGLOADER branch) shortly before an unexplained signed binary appeared.

Attack chain

Read the signer column as "victim." Every organisation named below is a legitimate company whose EV code-signing certificate was obtained fraudulently through the DigiCert support portal. A hit means the certificate is burned.

N1 · Support-channel delivery (ticketing / chat platforms)

• Export inbound attachments and links from the last 120 days on every customer-facing queue. Filter for archives whose contents include .scr, .com, .pif, or a double extension ending in an executable type.
• Zendesk / Salesforce / Intercom / Freshdesk: look for a first-contact ticket from an unknown requester whose only content is an attached "screenshot" and a request to view it.
• Check whether your ticketing platform detonates attachments at all. In the DigiCert case delivery was via chat, which typically bypasses the mail gateway entirely.

N2 · Sysmon — the certificate half Falcon does not expose

Falcon's process events do not publish the signer common name or certificate serial. Sysmon EventID 1 does. Run this on any host that returns a hit from Q1–Q4:

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=1} |
  ForEach-Object { [xml]$_.ToXml() } |
  ForEach-Object {
    $d = @{}; $_.Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
    [pscustomobject]$d
  } |
  Where-Object { $_.Signature -match 'Lenovo|Shuttle|PALIT|Luxvisions|DigiFors|Brunner|BlockCerts|MobSoft|INNOVATIVE CONNECTING|SoftStory' } |
  Select-Object UtcTime, Image, Signature, SignatureStatus, Hashes

N3 · Verify serials on a suspect file

$sig = Get-AuthenticodeSignature 'C:\path\to\suspect.exe'
$sig.Status
$sig.SignerCertificate.Subject
$sig.SignerCertificate.SerialNumber      # compare against the burned-serial list in S10
$sig.SignerCertificate.Issuer            # DigiCert Trusted G4 Code Signing RSA4096 SHA256/SHA384 2021 CA1, GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1, Verokey High Assurance Secure Code EV

N4 · Certificate-inventory audit (do this even with zero endpoint hits)

• If you hold DigiCert EV code-signing certificates, confirm with DigiCert whether any order of yours was in the affected window (approved but pending delivery, spring 2026), and whether your certificate was among the 60 revoked.
• Inventory every WDAC / AppLocker publisher rule. Any rule that trusts a subject name rather than a specific signing cert is now a standing risk.
• Confirm CRL / OCSP checking is actually reachable from endpoints. Revocation is the only control that makes a stolen certificate stop working, and it fails open on air-gapped or proxy-blocked hosts.

N5 · Network — plaintext WebSocket on low ports

On the proxy/firewall, hunt outbound TCP to ports 5188 and 5198 where the session is not TLS. Expel published Suricata coverage with Proofpoint (ETPro/ETOpen) keyed on the 12-byte header bytes; if you run Suricata, confirm the ET MALWARE GoldenGh0stLoader rules are enabled rather than writing your own.

Field note. Falcon publishes AuthenticodeHashData and SignInfoFlags on process and PE-write events, but it does not publish the signer common name or the certificate serial. Q1 and Q2 therefore hunt the signed-binary behaviour and known hashes; the subject/serial half is covered by the Sysmon and PowerShell hunts in Section 7. Baseline the values SignInfoFlags takes in your own tenant before filtering on a specific one.

// HUNT: Golden Gh0st samples signed with fraudulently obtained DigiCert EV certs
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2, PeFileWritten
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| in(SHA256HashData, values=[
    "81e276aaa3eb9b3f595663c316b3c6414cc3dde5e6cc3a82856b7276acabb7de",
    "d1b1938963037aa332591a4c999523a05886d1f62d80e03f0adc22630b8671c4",
    "27b722c66f69e360c4da106daacf3b9eeaabd20634d7e5eff45a28bd70ebfd65",
    "b48349b0454e0c1ee61990c85ee07c8c68397acc9e5fe980fbb930fc97d3f765",
    "411ea623229d591865748ad00c5f0d98eadeb711b9737584fc10d093be52de5a",
    "1abffe97aafe9916b366da57458a78338598cab9742c2d9e03e4ad0ba11f29bf",
    "4eaebd93e23be3427d4c1349d64bef4b5fc455c93aebb9b5b752981e9266488e",
    "2b0071007c3f5fa8e949a8de53be03e97901dd505694ca939b575a49e4fdbdbb",
    "c85911c6b8fa64bb84fe9a46c6f61e45c5aa8e47c73dfa839445a5037b1b43f9",
    "5e841260983954da60716b99306a410898bca4d30c14626553205753f60a6d2f",
    "55ce327ac004ed006bd7f11a3da301e9e5a853f79b2d5bad9ea9c83845d406af",
    "ba4de3c93d319523ab95cf3b724e6cef636e3890746c60067fd70b6f7792e428",
    "61b82798d812b2d4702dc1468fbada46e2f72e4d5b2598533ddbc33ac2fc843d",
    "36d22778dda953d192e7fd910faab2f4012421efbb35360ec7fe3e1c5109f1aa",
    "da2c58308e860e57df4c46465fd1cfc68d41e8699b4871e9a9be3c434283d50b",
    "82794015e2b40cc6e02d3c1d50241465c0cf2c2e4f0a7a2a8f880edaee203724",
    "c65170be2bf4f0bd71b9044592c063eaa82f3d43fcbd8a81e30a959bcaad8ae5",
    "2515b546125d20013237aeadec5873e6438ada611347035358059a77a32c54f5",
    "33b494eaaa6d7ed75eec74f8c8c866b6c42f59ca72b8517b3d4752c3313e617c"
  ])
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, TargetFileName, SHA256HashData, AuthenticodeHashData, CommandLine], limit=max)
| sort(@timestamp, order=desc)

// HUNT: signed-but-rare PE from a user-writable path (stolen code-signing cert abuse)
// CONF: high  FP: med  COST: med | REQUIRES: ProcessRollup2 with AuthenticodeHashData populated
// NOTE: AuthenticodeHashData is only populated for signed images - its presence IS the signed test
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| AuthenticodeHashData = *
| ImageFileName = /\\(Users|ProgramData|PerfLogs|Windows\\Temp|Windows\\Tasks)\\/i
| ImageFileName != /\\(Program Files|Program Files \(x86\)|Windows\\System32|Windows\\SysWOW64|Windows\\WinSxS)\\/i
// TUNING: drop your own signed updaters / management agents here, then baseline the
// TUNING: survivors once and re-run weekly - only new AuthenticodeHashData values matter
| FileName != /^(Teams|Update|SlackSetup|OneDriveSetup|GoogleUpdate|MicrosoftEdgeUpdate|setup|msedgewebview2|ninjarmm-cli)(\.exe)?$/i
| groupBy([AuthenticodeHashData, FileName, SHA256HashData],
          function=[count(as=Execs), count(ComputerName, distinct=true, as=Hosts), collect(ImageFileName, limit=4), collect(ComputerName, limit=8)],
          limit=5000)
// rarity gate: a stolen cert signs a payload that shows up on very few hosts
| Hosts < 4
| sort(Hosts, order=asc)

// HUNT: screenshot-lure executable delivered via support chat / ticketing
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName = /^((image|photo|screenshot|img|pic)[-_]?\d{4,14}\.(com|exe|scr|pif))|(.+\.(scr|pif))$/i
| ParentBaseFileName = /^(7zFM|7zG|WinRAR|Explorer|chrome|msedge|firefox|Teams|Slack|Discord|Telegram|outlook|zendesk|salesforce)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, ParentBaseFileName, ParentCommandLine, SHA256HashData, AuthenticodeHashData, CommandLine], limit=200)
| sort(@timestamp, order=desc)

// HUNT: DLL side-load pair + encrypted .log payload (Golden Gh0st Loader)
// CONF: high  FP: low  COST: low | REQUIRES: PeFileWritten / NewExecutableWritten / file-write telemetry
#event_simpleName=/^(PeFileWritten|NewExecutableWritten|ClassifiedModuleLoad|ImageHash)$/
| TargetFileName = /\\(crashreport|TASLoginBase|DataPlugin|Snieoatwtregoable|goldendays|plugin32|plug32)\.dll$/i
    or TargetFileName = /\\(updat|TASLogin|as|uu)\.log$/i
| TargetFileName != /\\(Program Files|Program Files \(x86\))\\/i
| table([@timestamp, ComputerName, UserName, TargetFileName, TargetDirectoryName, SHA256HashData, ContextBaseFileName, ImageFileName], limit=200)
| sort(@timestamp, order=desc)

// HUNT: Golden Gh0st RAT C2 - named domains OR plaintext WebSocket to 5188/5198
// CONF: high  FP: med  COST: low | REQUIRES: DnsRequest, NetworkConnectIP4
#event_simpleName=/^(DnsRequest|NetworkConnectIP4|NetworkConnectIP6)$/
| DomainName = /(^|\.)(goldeyeuu\.io|keensie\.com|qaqkongtiao\.com)$/i
    or RemotePort = 5188
    or RemotePort = 5198
// TUNING: exclude known-good clients that use these ports in your estate; after the
// TUNING: first baseline, alert only on new (ContextBaseFileName, RemotePort) pairs
| ContextBaseFileName != /^(steam|WeChat|QQ|DingTalk)(\.exe)?$/i
| groupBy([ComputerName, ContextBaseFileName, DomainName, RemoteAddressIP4, RemotePort],
          function=[count(as=Hits), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)],
          limit=5000)
| sort(Hits, order=desc)

// HUNT: RDP backdoor enablement (Golden Gh0st plugin32.dll)
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2 + registry telemetry
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|RegSystemConfigValueUpdate|AsepValueUpdate|RegGenericValueUpdate)$/
| CommandLine = /net(1)?\s+(user\s+\S+\s+\S+\s+\/add|localgroup\s+(administrators|administradores)\s+\S+\s+\/add)/i
    or CommandLine = /reg(\.exe)?\s+add.+(fDenyTSConnections|AutoAdminLogon|DefaultUserName|DefaultPassword)/i
    or CommandLine = /(sc|net)(\.exe)?\s+(config|start)\s+TermService/i
    or RegObjectName = /\\Control\\Terminal Server$/i
    or RegObjectName = /\\Windows NT\\CurrentVersion\\Winlogon$/i
| RegValueName != /^(Shell|Userinit|LastUsedUsername)$/i
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, RegObjectName, RegValueName, RegStringValue, ParentBaseFileName], limit=200)
| sort(@timestamp, order=desc)

// HUNT: Gh0st plugin credential sweep + keylogger/clipboard config
// CONF: med  FP: med  COST: low | REQUIRES: ProcessRollup2 + registry + file telemetry
// FALSE POSITIVES: password-manager imports and browser-migration tools also read these stores
// TUNING: exclude your approved password manager and profile-migration tooling below;
// TUNING: the taskkill-then-read ordering and the \offlinekey path are the real discriminators,
// TUNING: so triage those two branches first before working the file-artifact branch
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|RegGenericValueUpdate|AsepValueUpdate|PeFileWritten|NewExecutableWritten)$/
| ContextBaseFileName != /^(1Password|KeePass|KeePassXC|Bitwarden|LastPass|dashlane|BrowserMigration)(\.exe)?$/i
| CommandLine = /taskkill.+\/im\s+(chrome|firefox|skype|360se|360chrome|QQBrowser|msedge)\.exe/i
    or RegObjectName = /\\offlinekey/i
    or RegValueName = /^(newcharac|characLen|charac|clipboard)$/i
    or TargetFileName = /\\microsoft\.dotnet\.common\.log$/i
    or TargetFileName = /\\(avBackup\.dat|FormData3\.dat|historyUrl3\.db|history3\.db)$/i
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, RegObjectName, RegValueName, TargetFileName, ParentBaseFileName], limit=200)
| sort(@timestamp, order=desc)

// HUNT: Golden Gh0st RAT anti-forensic commands
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine = /InetCpl\.cpl,\s*ClearMyTracksByProcess/i
    or CommandLine = /wevtutil(\.exe)?\s+cl\s+(Application|Security|System)/i
    or CommandLine = /Clear-EventLog/i
    or CommandLine = /schtasks(\.exe)?\s+\/delete.+Windos\s*Defende/i
    or CommandLine = /(sc|net)(\.exe)?\s+(delete|stop)\s+.*(Windos|Defende)/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, ParentCommandLine], limit=200)
| sort(@timestamp, order=desc)

// HUNT: RONINGLOADER - PPL abuse, driver-based AV kill, TrustedInstaller injection
// CONF: high  FP: low  COST: med | REQUIRES: ProcessRollup2, service + file telemetry
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|ServiceStarted|PeFileWritten|NewExecutableWritten)$/
| CommandLine = /ClipUp(\.exe)?\s+-ppl/i
    or CommandLine = /mklink\s+\/D\s+.*ProgramData\\roming/i
    or CommandLine = /regsvr32(\.exe)?\s+\/S\s+.*ProgramData\\Roning\\goldendays\.dll/i
    or ServiceName = /^(xererre1|ollama|MicrosoftSoftware2ShadowCop4yProvider)$/i
    or ServiceImagePath = /\\(ollama|inject)\.sys$/i
    or TargetFileName = /\\Wow64\\Wow64Log\.dll$/i
    or TargetFileName = /\\drivers\\\d{6,8}\.temp$/i
    or TargetFileName = /\\ProgramData\\(Roning|lnk)\\/i
    or TargetFileName = /\\CiPolicies\\Active\\\{31351756-3F24-4963-8380-4E7602335AAE\}\.cip$/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, ServiceName, ServiceImagePath, TargetFileName, ParentBaseFileName], limit=200)
| sort(@timestamp, order=desc)

// HUNT: random-named .BAT watchdog in C:\Windows + SOCKS relay behaviour
// CONF: med  FP: med  COST: low | REQUIRES: ProcessRollup2 + file-write telemetry
// FALSE POSITIVES: legitimate admin batch scripts; portproxy used by real remote-access setups
// TUNING: exclude your deployment/RMM writer processes below; the discriminators are the
// TUNING: write location (C:\Windows\ root, not System32), the random mixed-case 8-12 char
// TUNING: stem, and the timeout/tasklist loop body - a named .bat in C:\Windows is usually IT
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|NewExecutableWritten|PeFileWritten)$/
| ContextBaseFileName != /^(ninjarmm-cli|TaniumClient|ccmexec|msiexec|SCNotification)(\.exe)?$/i
| TargetFileName = /\\Windows\\[A-Za-z]{8,12}\.bat$/
    or CommandLine = /cmd(\.exe)?\s+\/c\s+.*\\Windows\\[A-Za-z]{8,12}\.bat/
    or CommandLine = /tasklist.+(findstr|find)\s+.*\s+timeout\s+\/t\s+10/i
    or CommandLine = /netsh\s+interface\s+portproxy\s+add/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, TargetFileName, ParentBaseFileName, ParentCommandLine], limit=200)
| sort(@timestamp, order=desc)

Deployment path: Endpoint security → Custom IOA rule groups → assign to a pilot host group first, run 7 days in Detect, then promote the Block-rated rules. The screenshot-lure and ClipUp rules are safe to deploy directly to Block; everything else should serve a detect-only tour first.

1 · WDAC deny rules for the burned certificate serials

Generate a deny-by-serial supplemental policy. Run on a management host with the WDAC cmdlets available, then merge into your base policy and deploy in Audit mode first.

# Requires: Windows 11 / Server 2022+ management host, ConfigCI module
$serials = @(
  '0D2AD57B10B7472BAE03D3DEFF05F54F','0654CDA3DEFAF29DC152EF189C11E337',
  '0AF316CB4E5D9BAF35B35E85677B17EE','0AE04FFA7B23CC3F7395B25F41255157',
  '049209454DB22190C7697285C3D5AD9B','0CAE428F1BDCBEBAF284EEE9A643B1D8',
  '09186DCA3667374ADBD63A2F4FD96365','02ED93FDB6CFB33A477E218531F32922',
  '03A4E330B16DED8C61AD0FB23ECB2E1A','06500EE65FFBFB6EA4F4B16AB6F910C6',
  '0E53B99068FF7BF9C1BBBB025ECEDB58'
)
# Emit the serial list for your policy authoring tool / MDM console.
# WDAC deny-by-signer requires the signing cert; where you have a sample signed
# by one of these serials, extract the cert and build a Deny rule from it:
#   $c = (Get-AuthenticodeSignature .\sample.exe).SignerCertificate
#   $c | Export-Certificate -FilePath .\burned.cer
#   New-CIPolicyRule -DriverFilePath .\sample.exe -Level Publisher -Deny
# Then: Merge-CIPolicy, Set-RuleOption -Option 3 -Delete (leave Audit ON first),
#       ConvertFrom-CIPolicy, and deploy via MDM/GPO.
$serials | ForEach-Object { "DENY_SERIAL,$_" }

2 · Sweep the estate for the burned serials (agentless, via WinRM)

$burned = @(
 '0D2AD57B10B7472BAE03D3DEFF05F54F','0654CDA3DEFAF29DC152EF189C11E337',
 '0AF316CB4E5D9BAF35B35E85677B17EE','0AE04FFA7B23CC3F7395B25F41255157',
 '049209454DB22190C7697285C3D5AD9B','0CAE428F1BDCBEBAF284EEE9A643B1D8',
 '09186DCA3667374ADBD63A2F4FD96365','02ED93FDB6CFB33A477E218531F32922',
 '03A4E330B16DED8C61AD0FB23ECB2E1A','06500EE65FFBFB6EA4F4B16AB6F910C6',
 '0E53B99068FF7BF9C1BBBB025ECEDB58'
)
$paths = @("$env:PUBLIC","$env:ProgramData","$env:LOCALAPPDATA","$env:TEMP","C:\PerfLogs")
foreach ($p in $paths) {
  Get-ChildItem -Path $p -Recurse -Include *.exe,*.dll,*.sys,*.com,*.scr -ErrorAction SilentlyContinue |
    ForEach-Object {
      $s = Get-AuthenticodeSignature $_.FullName -ErrorAction SilentlyContinue
      if ($s.SignerCertificate -and $burned -contains $s.SignerCertificate.SerialNumber) {
        [pscustomobject]@{
          Host   = $env:COMPUTERNAME
          File   = $_.FullName
          Serial = $s.SignerCertificate.SerialNumber
          Subject= $s.SignerCertificate.Subject
          Status = $s.Status
          SHA256 = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
        }
      }
    }
}

3 · Block executable content from support channels (mail/gateway policy shape)

# Transport / chat DLP rule intent (translate to your platform):
BLOCK  attachment extension in { scr, pif, com, exe, msi, js, jse, vbs, lnk, hta, cpl }
BLOCK  archive containing any of the above, at any nesting depth
QUARANTINE  password-protected archive from an external, first-contact sender
APPLY TO  every customer-facing queue AND the live-chat/file-upload path,
          not just SMTP. The DigiCert delivery was a chat upload.
NOTIFY  the agent with a plain-language reason so they do not seek a workaround

4 · RDP backdoor hardening (GPO / registry)

# Deny RDP to local accounts (blocks the plugin32.dll backdoor account path)
# Computer Config > Policies > Windows Settings > Security Settings >
#   Local Policies > User Rights Assignment >
#   "Deny log on through Remote Desktop Services" -> add: Local account

# PowerShell (run elevated). Each reg add is one line on purpose -- a CMD caret (^)
# continuation does not work in PowerShell, and this block previously mixed the two.

# Require Network Level Authentication
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 1 /f

# Ensure RDP stays disabled where it is not required
# WARNING: this disables inbound RDP on the host. Confirm out-of-band access
# (console/iLO/DRAC) before running it on a remote server.
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 1 /f

# Verify:
#   reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication
# Rollback:
#   reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

# Block autologon abuse - these values should never be set on a managed endpoint
# Audit: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
#        AutoAdminLogon, DefaultUserName, DefaultPassword, DefaultDomainName

5 · Defender / EDR tamper resistance (RONINGLOADER branch)

# PowerShell (run elevated). Each reg add is one line on purpose -- a CMD caret (^)
# continuation does not work in PowerShell, and this block previously mixed the two.

# Tamper Protection is NOT settable from here. When it is on, Set-MpPreference calls
# that alter protection settings are blocked by design; the old line in this block
# (Set-MpPreference -DisableTamperProtection $false) was decorative at best and threw
# access-denied at worst. Set it in Intune / the Defender portal, then confirm locally:
Get-MpComputerStatus | Select-Object IsTamperProtected, AMRunningMode

# Microsoft Vulnerable Driver Blocklist. Independent of HVCI -- this works on its own
# and is what actually blunts an ollama.sys-style AV-kill driver.
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 1 /f

# HVCI. The scenario key ALONE does not enable it -- VBS must be enabled as well, or
# the control silently never activates. All three values are required.
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v RequirePlatformSecurityFeatures /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 1 /f

# Prerequisites: UEFI + Secure Boot + virtualization extensions. Reboot required.
# PILOT FIRST -- incompatible legacy drivers can block boot under HVCI.
# Verify AFTER reboot (must contain 2 for HVCI):
#   (Get-CimInstance Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning
# Rollback:
#   reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 0 /f
#   reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
#   (then reboot; if the host will not boot, use Safe Mode or WinRE to revert)

# Alert on any write to the active WDAC policy directory - RONINGLOADER drops its own
#   C:\Windows\System32\CodeIntegrity\CiPolicies\Active\*.cip

Validation. Coverage above is claimed only after the Section 11 gates pass: G1 proves AuthenticodeHashData is actually populated (without it Q2's "PARTIAL" is really a GAP), G3 proves Q2 is reviewable rather than a wall of installers, and G4–G6 prove Q3, Q5 and Q6 fire on real activity. Re-run G1 after any ingest or field-filtering change — the signature fields are the first thing a bandwidth-trimming exercise removes, and their loss is silent.

Every atomic indicator in this pack was traced back to one of the cited sources above at build time; nothing is included that a source does not state.

Generated 2026-07-20 · HuntPack pipeline (huntpack-agent-v2 → review-v2). Defensive content only.