OfferLoader | CL-CRI-1171 — Pay-Per-Install Malware Distribution Network

CL-CRI-1171 is a pay-per-install (PPI) cybercrime distribution network that Unit 42 (Palo Alto Networks) has tracked for at least two years. The operator sells infection access to independent buyers, each of whom deploys their own payload through the same disposable, generic Inno Setup loader, which Unit 42 named OfferLoader after the offer_execution / offer_execution_fail / offer_exists variable names found in its C2 traffic. Victims are funneled in through two channels: SEO-poisoned search results promoting trojanized versions of legitimate utilities (WinDirStat, Bluetooth drivers), and at least 11 YouTube gaming-optimization channels with hundreds of thousands of subscribers. Unit 42 has identified more than 10,000 distinct loader samples and over 200 rotating two-word-compound C2 domains across the .xyz, .cfd, .space, and .info TLDs.

Once installed, OfferLoader beacons for an install verdict and then spawns three child processes, eld0.exe, eld1.exe, and eld2.exe, each an independent malware campaign with its own C2 and objective. The April 2026 intrusion set Unit 42 documented in depth delivered three payloads: Insomnia RAT (a dual Node.js/Python cross-platform backdoor, user-agent insomnia/2023.4.0 Windows), ARKTunnel (a previously undocumented WebSocket tunneling RAT extracted from a bitmap image via LSB steganography), and Docro Hijacker (a Chrome browser hijacker that forges valid HMAC signatures to bypass Chrome's Secure Preferences integrity check and sideload a search-hijacking extension). A separate June 2026 intrusion delivered two different payloads (GCleaner, Socks5Systemz) through the same loader, confirming the payload slots are interchangeable and not fixed to this campaign's three headline families.

Defender priority: the distinctive, low-noise signal in this pack is the eld0.exe/eld1.exe/eld2.exe child-process fan-out and the exact hashes of the documented samples (Q1, Q3). The rotating two-word-compound domain infrastructure (>200 hostnames observed, expected to keep rotating) is inherently high-false-positive as a standalone signal and is shipped as a low-priority triage feed only (Q10), never a block list. The in-memory BMP steganographic extraction and the in-browser SERP script injection are both invisible to endpoint telemetry by design; see Section 15 for the honest coverage picture.

Four sources were fetched and saved verbatim as plain-text snapshots before any content in this pack was written. No fetched source contained text directed at an automated reader (no instructions to change tooling, fetch further URLs, skip steps, or claim prior authorization); all four were treated strictly as data to analyze, per standing security policy.

Provenance decisions

• Every atomic indicator in this pack traces to a single underlying investigation. The two press write-ups (Cyber Security News, GBHackers) both explicitly cite Unit 42 as their source rather than presenting independent research; they are treated as re-publication of the same investigation, not a second independent source. Per standing policy that action=prevent or critical severity requires two independent sources, every hash and domain in this pack ships at action=detect or action=hunt, severity high or medium — never prevent, never critical.
• All 16 file hashes and 15 domains in the IOC Appendix (Section 10) were verified present in the saved Unit 42 snapshot (01-unit42-cl-cri-1171.txt) before being included; nothing was invented or carried over from an unrelated cluster.
• Unit 42's sanitized victim-IP examples (e.g. 5.xxx.xx.xxx) are illustrative fragments, not real addresses, and are not shippable IOCs; no IPv4/IPv6 indicator appears in this pack.
• The three "gate/landing" domains carried into the CSV (bubbleslip.xyz, churchpail.xyz, dinosaursjam.cfd) are Unit 42's own worked examples of the >200-domain rotation pattern, shipped at low confidence/short expiry explicitly labeled illustrative — they are pattern samples, not a live blocklist, since the full rotation is expected to have moved on by the time this pack is read.
• The Malwarebytes 2015 article is cited only for the Secure-Preferences-tampering technique lineage; none of its own indicators (unrelated to CL-CRI-1171) are shipped here.

Hunt hypotheses

• H1 (high confidence). Any host spawning processes named eld0.exe, eld1.exe, or eld2.exe has run the OfferLoader chain; the naming is unique to this loader family. MITRE T1204.002/T1027. Telemetry: ProcessRollup2. FP: low. → Q1.
• H2 (medium confidence). A trojanized installer masquerading as windirstat.exe or a Bluetooth-driver installer, executing from a Downloads/Temp path, precedes the eld0-2 fan-out. MITRE T1204.002/T1036.005. Telemetry: ProcessRollup2. FP: medium (legitimate installers also run from these paths). → Q2.
• H3 (high confidence). Exact-hash matches against the 16 published samples confirm this specific, already-analyzed campaign wave. MITRE T1204.002. Telemetry: ProcessRollup2 (SHA256HashData). FP: low. → Q3.
• H4 (high confidence). Insomnia RAT's installer disables Defender and excludes the entire C:\ drive before deploying its Node.js/Python agents — a distinctive, rarely-legitimate command-line pattern. MITRE T1562.001. Telemetry: ProcessRollup2 (CommandLine). FP: medium. → Q4.
• H5 (high confidence). Insomnia RAT persists via two masquerading scheduled tasks with non-Microsoft naming under Microsoft-owned task paths. MITRE T1053.005. Telemetry: ScheduledTaskRegistered. FP: low. → Q5.
• H6 (medium confidence). Node.js is hidden from Add/Remove Programs via a SystemComponent=1 registry write, correlating with the Insomnia install chain. MITRE T1112. Telemetry: RegGenericValueUpdate. FP: medium. → Q6.
• H7 (high confidence). ARKTunnel's dropped ZIP (procorTrex.zip), executable (wscl.exe), and Windows service (wscl-13/msvcsrvc) are all distinctively named and not used by legitimate software. MITRE T1027.003/T1543.003. Telemetry: ZipFileWritten, NewExecutableWritten, CreateService. FP: low. → Q7.
• H8 (medium confidence). Docro Hijacker's Chrome Secure Preferences tamper and docro extension drop under C:\ProgramData\DocsHelper\ are visible as file-write events even though the HMAC-bypass logic itself is not. MITRE T1176/T1112. Telemetry: CriticalFileModified, NewExecutableWritten. FP: medium. → Q8.
• H9 (high confidence). DNS resolution to any of the 10 confirmed second-stage/C2 domains is a strong, campaign-specific signal, including the crowdstri.com CrowdStrike typosquat. MITRE T1071.001/T1583.001. Telemetry: DnsRequest. FP: low. → Q9.
• H10 (low confidence, explicit triage-only). The two-word-compound domain naming shape (six-to-eighteen lowercase letters, no digits or hyphens, over .xyz/.cfd/.space/.info) can be pattern-matched, but the shape alone is common to a lot of benign and parked domains. MITRE T1583.001. Telemetry: DnsRequest. FP: high. → Q10.
• H11 (medium confidence). Insomnia RAT's C2 traffic carries the literal HTTP User-Agent insomnia/2023.4.0 Windows, visible only in ingested web-proxy/NGSIEM logs, not native EDR telemetry. MITRE T1071.001/T1036.005. Telemetry: NGSIEM proxy log fields. FP: low, but shares its UA with the legitimate Insomnia REST client. → Q11.

Two attack-chain steps have no mappable Falcon telemetry and are carried forward as explicit gaps rather than silently dropped: the in-memory LSB steganographic extraction of ARKTunnel's payload from a BMP resource, and the in-browser SERP script injection Docro Hijacker uses to monetize search results. Both are addressed in Section 15.

Attack chain

Every row below traces to the primary Unit 42 investigation (Section 2). Because that investigation is the sole underlying source for every atomic indicator in this pack, no row ships at action=prevent or severity=critical, regardless of how corroborated its republication in secondary press was — per standing two-source policy. Action follows the pack's standard vocabulary (detect = alert/import as IOC, hunt = investigate, enrich = context only).

These checks require no CQL and directly cover the extension-governance and dropped-artifact gaps noted in Section 15.

RTR one-time fleet sweep (read-only, point-in-time)

Run via Falcon Real Time Response across the fleet to confirm on-disk/service/task presence. See the Fleet Audit Commands quick-copy block in Section 10 for the exact commands (ARKTunnel service check, scheduled-task check, docro extension path check, Secure Preferences modification time check).

Chrome / Edge (Chromium) — managed browser extension inventory

• Google Admin console → Chrome browser cloud management → Apps & extensions → Users & Browsers report — the sideloaded docro extension has no fixed Chrome Web Store ID (it is sideloaded from disk, not installed from the store), so hunt by installed-extension name/path rather than a store ID.
• Microsoft Intune / Edge Business inventory — same approach if Edge extension reporting is configured.

Windows Service Control Manager

• sc query wscl-13 / sc query msvcsrvc across the fleet (or the RTR batch equivalent in Section 10) to find ARKTunnel's installed service before or after a Q7 network hit.

Task Scheduler operational log

• Enable Microsoft-Windows-TaskScheduler/Operational (disabled by default on most builds) and alert on new task registrations under \Microsoft\Windows\Maps\ or \Microsoft\Windows\Servicing\ that do not match your organization's known-good task baseline — see Playbook 4 in Section 13.

Perimeter DNS / secure web gateway logs

Query Umbrella / Zscaler / firewall logs for the domains in Section 4. Unlike Falcon, a web gateway typically logs the full request path, which is the only way to confirm the Docro extension's /extensionInstaller/updateChromeExtension and similar config-endpoint paths actually fired.

Honesty note: the highest-confidence signal in this pack (Q1, the eld0/eld1/eld2 child-process chain) is exactly the kind of narrow, distinctive process-naming pattern a Falcon Custom IOA is built for. The domain-pattern hunt (Q10) is the opposite case — too broad and too high-FP for a Custom IOA, and belongs only as an investigate-only Scheduled Search at most.

The Falcon IOC Management CSV below is the only block whose atomic indicators are mechanically traced to the saved source snapshots. The other blocks are practical quick-copy references (operator/protocol details, named tooling, and fleet audit commands) that are not Falcon-importable IOC types.

type,value,action,severity,expiration,description,tags
sha256,7f792c45de1e28fd42ac44c9444f157a2161742d130bac336c0e991aabbb112c,detect,high,2026-12-25,Trojanized windirstat.exe Inno Setup 6.7.1 initial-access installer,campaign:cl-cri-1171 family:offerloader
sha256,fc485882626512e7ff82a1d7cd8e8fb3e9751b026d97e682d6908aefff1f2d73,hunt,medium,2026-11-10,windirstat.tmp unpacked stage (single-source),campaign:cl-cri-1171 family:offerloader
sha256,3052bd320a34e12ee694811ed0578797477dfd480c664491e509ed15ce1a6961,detect,high,2026-12-25,eld0.exe Insomnia RAT initial loader,campaign:cl-cri-1171 family:offerloader
sha256,25558ea78c4aa0fdd0f45fafcaa546d3115dc5806809d144a5801a40e48fd4c5,hunt,medium,2026-11-10,eld0.tmp unpacked loader stage (single-source),campaign:cl-cri-1171 family:offerloader
sha256,9b0d9cbc0fd4a7bae8b78a15dfbe63052779414ad725845732c4a0083008da69,detect,high,2026-12-25,a.dll executes PowerShell downloader for Node.js/Python stages,campaign:cl-cri-1171 family:insomnia-rat
sha256,ceb30a5eb9ad9d9c6712c80726df16f96f99d9fc0753be241b00b4d636eb576e,detect,high,2026-12-25,t.ps1 Insomnia RAT PowerShell installer (Defender disable + C: exclusion),campaign:cl-cri-1171 family:insomnia-rat
sha256,cf184d04ca31fb2b6b7efd85399c29c1136b539153e137ceb3877b1b905791de,detect,high,2026-12-25,GUID-named Python component of Insomnia dual payload (filename randomized per build),campaign:cl-cri-1171 family:insomnia-rat
sha256,62d49d0c78207ec2452cc8a30501db771c9edbae89889e41a7dd227551243e8e,detect,high,2026-12-25,aa.js Node.js component of Insomnia dual payload,campaign:cl-cri-1171 family:insomnia-rat
sha256,aaebc8c07de485be6d1bfa956668c5e18aa1ff5588dfe84672e20ae90b4560f1,detect,high,2026-12-25,eld1.exe ARKTunnel LSB-steganography dropper,campaign:cl-cri-1171 family:arktunnel
sha256,e05bc22afbc5ddd50b49c85ee169dd13318000d38286de2b8bcff98217256a8d,hunt,medium,2026-11-10,procorTrex.zip carved from eld1.exe BMP steganography payload (single-source),campaign:cl-cri-1171 family:arktunnel
sha256,b367762140ae7f5098230b8a5da738c9241f286281ec9439dd6ca581fc87989c,detect,high,2026-12-25,wscl.exe ARKTunnel WebSocket tunneling RAT,campaign:cl-cri-1171 family:arktunnel
sha256,d8d783f8e050a6e394f3c0aa5e2bc73a38d822e55fbc39c0648cbff566de3cdf,hunt,medium,2026-11-10,ARKTunnel shared resource icon (retro-hunt only; single-source),campaign:cl-cri-1171 family:arktunnel
sha256,06e0afd01bbc6c9d5dc16c3165089b233dc071e1f251abd06235d1b9166cdac5,hunt,medium,2026-11-10,ARKTunnel shared resource icon #2 (retro-hunt only; single-source),campaign:cl-cri-1171 family:arktunnel
sha256,2c6e11027b011042c9a118fc20728f8f4ebb6be8795cc84cc9a45622c297d354,detect,high,2026-12-25,eld2.exe Docro Hijacker installer,campaign:cl-cri-1171 family:docro-hijacker
sha256,553ce594c9c6afdd4794fddc28c194e3bc3c1b052310e5099c58ac15bab72104,hunt,medium,2026-11-10,eld2.tmp unpacked stage (single-source),campaign:cl-cri-1171 family:docro-hijacker
sha256,fdcc95b7791c0d6590dcf1a412dc9fcc92ad2095818d1b78368b31efad012007,detect,high,2026-12-25,Adblock.dll Chrome Secure Preferences HMAC-bypass DLL,campaign:cl-cri-1171 family:docro-hijacker
domain,stryper.info,detect,high,2026-12-25,Insomnia RAT Node.js agent host (aa.js POST /d /e),campaign:cl-cri-1171 family:insomnia-rat
domain,aa.amazingshield.xyz,detect,high,2026-12-25,Insomnia RAT Python agent host,campaign:cl-cri-1171 family:insomnia-rat
domain,crowdstri.com,detect,high,2026-12-25,CrowdStrike-typosquat C2 for Insomnia RAT Python agent,campaign:cl-cri-1171 family:insomnia-rat
domain,reg.pcsdkflyer.ca,detect,high,2026-12-25,ARKTunnel (wscl.exe) WebSocket C2,campaign:cl-cri-1171 family:arktunnel
domain,vendralo.info,detect,high,2026-12-25,Docro Hijacker per-victim UUID and hourly rewrite-rule delivery,campaign:cl-cri-1171 family:docro-hijacker
domain,finersto.com,hunt,medium,2026-11-10,Docro Hijacker extension install/start telemetry (single-source),campaign:cl-cri-1171 family:docro-hijacker
domain,drelto.info,detect,high,2026-12-25,Docro Hijacker SERP-injection script host (/farlix),campaign:cl-cri-1171 family:docro-hijacker
domain,mqsearch.com,detect,high,2026-12-25,Docro Hijacker hijacked default search provider endpoint,campaign:cl-cri-1171 family:docro-hijacker
domain,extentrack.com,hunt,medium,2026-11-10,Docro Hijacker install-success/failure callback (single-source),campaign:cl-cri-1171 family:docro-hijacker
domain,voyagemist.space,hunt,medium,2026-11-10,OfferLoader initial tracking beacon / install-verdict gate,campaign:cl-cri-1171 family:offerloader
domain,noiseship.cfd,hunt,medium,2026-10-10,SEO-poison lure domain registered 39 days before observed use -- perishable,campaign:cl-cri-1171 family:offerloader
domain,atthelake.info,hunt,medium,2026-10-10,Top referring SEO-poison domain -- perishable,campaign:cl-cri-1171 family:offerloader
domain,bubbleslip.xyz,hunt,low,2026-10-10,Illustrative example of the rotating two-word-compound gate pattern -- NOT a live blocklist entry,campaign:cl-cri-1171 family:offerloader
domain,churchpail.xyz,hunt,low,2026-10-10,Illustrative example of the rotating two-word-compound gate pattern -- NOT a live blocklist entry,campaign:cl-cri-1171 family:offerloader
domain,dinosaursjam.cfd,hunt,low,2026-10-10,Illustrative example of the rotating two-word-compound gate pattern -- NOT a live blocklist entry,campaign:cl-cri-1171 family:offerloader

# Operator/loader variable names (compiled Pascal [Code] section, not directly queryable, context only)
offer_execution, offer_execution_fail, offer_exists

# OfferLoader child-process fan-out (see Q1)
eld0.exe -> Insomnia RAT (Operation A)
eld1.exe -> ARKTunnel (Operation B)
eld2.exe -> Docro Hijacker (Operation C)

# Insomnia RAT C2 protocol
user_agent: insomnia/2023.4.0 Windows
endpoints: POST /d (tasking), POST /e (error reporting)
persistence: "Maps Performance Task" under \Microsoft\Windows\Maps\ ; "OOBETaskScheduler" under \Microsoft\Windows\Servicing\

# ARKTunnel service persistence (see Q7)
service_names: wscl-13, msvcsrvc (delayed autostart)
c2_config_decode: Base64 -> XOR, 39-byte blob

# Docro Hijacker paths (see Q8)
extension_path: C:\ProgramData\DocsHelper\docro\
dll_path: %TEMP%\Adblock.dll
serp_injection_script: drelto.info/farlix

# Known affiliate IDs observed in the two documented intrusion sets (context, not a hunt indicator)
CID=2855 (Bluetooth Driver for Windows 10.exe intrusion set)
CID=3075 (windirstat.exe intrusion set)

Cluster:             CL-CRI-1171 (Unit 42 attribution framework)
Loader:              OfferLoader (disposable, generic Inno Setup trojanized-installer loader)
Payload A:            Insomnia RAT -- dual Node.js/Python cross-platform backdoor
Payload B:            ARKTunnel -- WebSocket tunneling RAT, LSB-steganography staged
Payload C:            Docro Hijacker -- Chrome Secure Preferences hijacker + search extension

ARKTunnel fabricated corporate-identity rotation (attribution signal, not a hunt indicator):
  EarthLink   (May 2025)          -- coincidental use of a real ISP's name
  EarthChain  (May 2025-Apr 2026) -- coincidental use of a real company's name
  EarthKark   (Feb 2026-Jun 2026) -- fully fictitious identity
  TamarkLark  (Mar 2026-Jun 2026) -- fully fictitious identity; PE metadata: "TamarkLark Corporation" / "TamarkLark Manager"

Scale (per Unit 42, 2026-09-09): >10,000 distinct OfferLoader samples; >200 rotating C2/gate domains;
  >=50 ARKTunnel samples over 1 year; observed distribution window June 2025-April 2026; 11 YouTube
  channels (since removed) and a parallel SEO-poisoning funnel; targets include gamers (YouTube funnel)
  and corporate/critical-infrastructure/government endpoints (SEO funnel).

# ARKTunnel service presence
Get-Service -Name wscl-13,msvcsrvc -ErrorAction SilentlyContinue

# Insomnia RAT masquerading scheduled tasks
Get-ScheduledTask -TaskName "Maps Performance Task","OOBETaskScheduler" -ErrorAction SilentlyContinue

# Docro Hijacker sideloaded extension path
Get-ChildItem "C:\ProgramData\DocsHelper\docro" -ErrorAction SilentlyContinue

# Chrome Secure Preferences recent-modification check (all local profiles)
Get-ChildItem "$env:LOCALAPPDATA\Google\Chrome\User Data\*\Secure Preferences" -ErrorAction SilentlyContinue |
  Select-Object FullName, LastWriteTime

# ARKTunnel dropped artifact
Get-ChildItem "C:\Users\Public\procorTrex.zip" -ErrorAction SilentlyContinue

Telemetry ready

ProcessRollup2, DnsRequest, ZipFileWritten, NewExecutableWritten, CreateService, ScheduledTaskRegistered, and RegGenericValueUpdate must be enabled and flowing (default Falcon sensor policy covers all seven on Windows). Confirm with #event_simpleName=ProcessRollup2 | groupBy(ComputerName, function=count(), limit=10) against a small pilot group before relying on Q1-Q9.

Benign baseline

Run Q1, Q3, Q5, and Q9 with a 30-day console lookback and confirm a zero (or near-zero, fully explained) baseline before enabling any of them as a Scheduled Search. Any pre-existing hits should be triaged as already-compromised endpoints, not tuned away. Run Q10 once against the same window purely to gauge its baseline noise volume in your environment before ever running it live.

Positive tests

Validate Q1 and Q5 against a lab-owned host that spawns a harmless, uniquely-named process called eld1.exe (or registers a scheduled task named exactly "OOBETaskScheduler") rather than resolving or executing any live campaign domain or sample from production. Do not run confirmed campaign hashes or resolve confirmed campaign domains from a production endpoint for testing.

Promotion

Q1, Q3, Q5, and Q9 are the IOA/Scheduled-Search candidates (CONF high, FP low). Q2, Q4, Q6, Q7, Q8, and Q11 remain investigate-only pending periodic re-validation. Q10 never promotes past manual triage, per its explicit high-FP labeling in Section 8.

Playbook 1 — Disable Defender local-admin exclusion merge (PowerShell / Intune)

Prerequisites: local admin or Intune/GPO push rights. Reboot required: no — Defender re-reads the setting on next policy sync. Rollback: Set-MpPreference -DisableLocalAdminMerge $false.

Set-MpPreference -DisableLocalAdminMerge $true

Verify: Get-MpPreference | Select-Object DisableLocalAdminMerge returns True; a subsequent local Add-MpPreference -ExclusionPath "C:\" no longer appears in the effective exclusion list returned by Get-MpPreference | Select-Object -ExpandProperty ExclusionPath once managed policy is present.

Playbook 2 — Chrome enterprise policy: lock default search + block unmanaged extensions

Prerequisites: write access to Chrome policy delivery (GPO ADMX, Intune, or Google Admin console for managed ChromeOS/Chrome Browser Cloud Management). Reboot required: no — restart Chrome to pick up policy. Rollback: remove the JSON keys below and restart Chrome.

{
  "DefaultSearchProviderEnabled": true,
  "DefaultSearchProviderName": "Google",
  "DefaultSearchProviderSearchURL": "https://www.google.com/search?q={searchTerms}",
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": ["REPLACE_WITH_your_approved_extension_ids"]
}

Verify: chrome://policy on a test endpoint shows both policies applied; chrome://extensions with Developer Mode on shows any unpacked/sideloaded extension (including a test copy of docro's manifest structure) blocked from loading; the default search box shows the managed provider and offers no alternate-provider option in Settings.

Playbook 3 — AppLocker path-deny rule for Downloads/Temp execution

Prerequisites: local admin or GPO push rights to Application Control Policies. Reboot required: no — AppLocker re-evaluates on next policy refresh / Application Identity service poll. Rollback: remove or disable the deny rule and re-run gpupdate /force.

<AppLockerPolicy Version="1">
  <RuleCollection Type="Exe" EnforcementMode="Enabled">
    <FilePathRule Id="REPLACE_WITH_new_guid" Name="Deny exe from Downloads" Description="Blocks OfferLoader-style installer execution from Downloads" UserOrGroupSid="S-1-1-0" Action="Deny">
      <Conditions>
        <FilePathCondition Path="%USERPROFILE%\Downloads\*.exe" />
      </Conditions>
    </FilePathRule>
    <FilePathRule Id="REPLACE_WITH_new_guid_2" Name="Deny exe from Temp" Description="Blocks unpacked installer stages from user Temp" UserOrGroupSid="S-1-1-0" Action="Deny">
      <Conditions>
        <FilePathCondition Path="%USERPROFILE%\AppData\Local\Temp\*.exe" />
      </Conditions>
    </FilePathRule>
  </RuleCollection>
</AppLockerPolicy>

Apply with Set-AppLockerPolicy -XmlPolicy "C:\Policies\DenyDownloadsTempExec.xml" -Merge and add publisher-condition exceptions for your approved deployment tooling before enforcing. Verify: Get-AppLockerPolicy -Effective -Xml includes both rules; a test .exe copied to Downloads and launched is blocked with the standard AppLocker denial dialog.

Playbook 4 — Enable Task Scheduler operational logging (fleet-wide)

Prerequisites: local admin or RTR/GPO push rights. Reboot required: no. Rollback: wevtutil sl Microsoft-Windows-TaskScheduler/Operational /e:false.

wevtutil sl Microsoft-Windows-TaskScheduler/Operational /e:true

Verify: wevtutil gl Microsoft-Windows-TaskScheduler/Operational shows enabled: true; registering a test scheduled task produces Event ID 106 in that log, confirming the pipeline is live for SIEM/NG-SIEM ingestion.

Playbook 5 — Fleet-wide RTR eradication sweep (ARKTunnel service + Insomnia tasks)

Prerequisites: Falcon RTR enabled and admin rights to run a batch RTR script. Reboot required: no. Rollback: none required for the detection half; the removal commands are themselves the remediation action, run only after Section 14 Identify/Triage confirms compromise.

sc query wscl-13
sc query msvcsrvc
sc stop wscl-13
sc delete wscl-13
sc stop msvcsrvc
sc delete msvcsrvc
schtasks /delete /tn "Maps Performance Task" /f
schtasks /delete /tn "OOBETaskScheduler" /f

Verify: repeat sc query and schtasks /query /tn "..." for each name and confirm "service does not exist" / "task not found"; re-run the Section 10 Fleet Audit Commands to confirm no remaining artifacts.

Validation gates (Section 11, summarized): telemetry readiness confirmed via a pilot ProcessRollup2/DnsRequest check; benign baseline required before promoting Q1/Q3/Q5/Q9; positive-test against a lab host, never a live campaign hash or domain, before production use; Q1/Q3/Q5/Q9 promote to Scheduled Search, Q2/Q4/Q6/Q7/Q8/Q11 stay investigate-only, and Q10 never promotes past manual triage.