ShellterLoader — Windows Downloader / Dropper

Multi-stage reflective-loading loader that masquerades as Chrome, Edge, and Windows system binaries to stage a second-stage payload over a websocket C2 · single-source reporting, detect-only pack
Threat
ShellterLoader
Severity
HIGH (loader risk)
Type
Downloader / Dropper
Access
User-level execution (no privesc reported)
Version
v1.2 · 2026-10-09
Author
HuntPack
Confidence
Medium — single source
01

Executive Summary

ShellterLoader is a Windows downloader/dropper reported by CYFIRMA in its Weekly Intelligence Report dated 2026-10-01. It is not itself a data-theft tool: its job is to establish an initial foothold and retrieve a second-stage payload, making the visible sample only one link in a longer chain. On startup it creates two named mutexes (ChromeProcessSingletonStartup! and OMADM_NAMED_MUTEX) to enforce a single running instance, then runs basic environment checks and may alter its behavior or terminate if the host looks unsuitable for continued execution (analysis evasion). It masquerades as, or runs from paths and under names associated with, Chrome, Edge, and Windows system binaries (chrome.exe, msedge.exe, BackgroundTaskHost.exe, RuntimeBroker.exe) and mimics Chromium user-data artifacts. It uses reflective loading and in-memory execution, with memory and thread manipulation consistent with code injection into another process's context, to retrieve and stage its next-stage payload over a websocket channel at wss.scriptlab.cc. CYFIRMA's own narrative also describes the loader communicating with, or masquerading traffic as, the legitimate comScore analytics domain sb.scorecardresearch.com during payload retrieval.

Single-source caveat: as of this pack's build date, CYFIRMA is the only source located for ShellterLoader under this name. A targeted search (threat name, sample hashes, named mutexes) found no independent corroboration. Per this pipeline's two-source rule, every indicator in this pack ships at action=detect only — nothing is promoted to Prevent or Critical. Treat any hit as a precursor to a broader compromise: the second-stage payload is not described in the available reporting.

Defender priority: sb.scorecardresearch.com is a legitimate third-party comScore analytics domain. CYFIRMA's own text frames ShellterLoader as masquerading as, or abusing, traffic to it — not owning it. Do not block this domain. The actionable, low-noise signals are path/name anomalies on Chrome/Edge/system-binary masquerades and the dedicated scriptlab.cc C2 domain.

02

Source Review & Web Hunter Notes

TierSourceKey FindingCarry Fwd
1CYFIRMA — Weekly Intelligence Report, 1 Oct 2026, "Active Malware of the Week: ShellterLoader"Full attack-method narrative, two named mutexes, masquerading paths, command-line fragment, reflective-load/injection description, YARA rule with 3 sample hashes and 16 strings, MITRE ATT&CK tableyes

Web-hunter note: This is a single-source pack. A targeted search for independent corroboration (the exact name "ShellterLoader", the sample SHA-256, and the mutex name ChromeProcessSingletonStartup!) returned no second report on this family. Search results instead surfaced an unrelated story — the legitimate commercial Shellter AV/EDR evasion framework being abused by infostealer actors after a leaked license (SecurityWeek, BleepingComputer, Elastic Security Labs, CrowdStrike blog, mid-2025). That campaign is a different tool, a different timeframe, and uses none of ShellterLoader's hashes, mutexes, or C2 infrastructure — it is explicitly excluded from this pack's indicators per the dedupe-by-TTP rule. All atomic indicators below trace only to the CYFIRMA snapshot in ShellterLoader-Hunt-sources/01-cyfirma-weekly.txt.

03

Hunt Brief & Attack Chain

Hunt hypotheses (ordered by fidelity)

  1. H1 (high): A binary named chrome.exe executes from a user-writable AppData\Local\Chromium\Application path rather than a real browser install location. → Q1
  2. H2 (medium): msedge.exe runs with the first-run-suppression flag combo from a non-interactive parent. → Q2
  3. H3 (high): RuntimeBroker.exe / BackgroundTaskHost.exe execute from outside System32. → Q3
  4. H4 (medium): RuntimeBroker.exe / BackgroundTaskHost.exe are spawned by a non-svchost.exe parent even when the path looks standard. → Q4
  5. H5 (medium): The --no-first-run --no-default-browser-check flag combo appears on a process whose name is not chrome.exe/msedge.exe (a renamed loader carrying the same flags). → Q5
  6. H6 (high): A host resolves the known C2 domain scriptlab.cc. → Q6
  7. H7 (high): Execution of a known ShellterLoader sample hash. → Q7
  8. H8 (low, hunt-only): A non-browser process contacts sb.scorecardresearch.com — legitimate infrastructure named in the reporting as abused/masqueraded for payload retrieval; context-only, never a block candidate. → Q8

Attack chain

StepBehaviorTelemetryHunt Angle
1 · GuardrailCreate ChromeProcessSingletonStartup! + OMADM_NAMED_MUTEX; enforce single instanceNot CQL-queryable (s7)Behavioral only — gap
2 · EvasionBasic environment/host-suitability checks; may alter behavior or terminateNot CQL-queryable (s7)Behavioral only — gap
3 · MasqueradeRun as/mimic chrome.exe, msedge.exe, BackgroundTaskHost.exe, RuntimeBroker.exe; mimic Chromium user-data artifactsProcessRollup2 (FileName, FilePath, CommandLine, ParentBaseFileName)Q1, Q2, Q3, Q4, Q5
4 · Reflective load / injectionMemory and thread manipulation consistent with code injection into another processNot CQL-queryable (s7)Behavioral only — gap
5 · Payload staging / C2Retrieve next-stage payload over websocket to scriptlab.cc; traffic masquerading as/abusing sb.scorecardresearch.comDnsRequestQ6, Q8
6 · Known sampleExecution of the published SHA-256/SHA1/MD5ProcessRollup2 (hash fields)Q7
7 · Unknown next stageSecond-stage payload — not described in the available reportingUnassessedTreat as precursor; widen the hunt, do not close on loader removal alone
04

Consolidated IOC Table

Single-source (CYFIRMA, 2026-10-01). Every indicator below ships for detection only — see s11 for the promotion criteria.

TypeValueConfActionContext
sha256594033ed58e27b42bb1bef7e5b21eac87f0d660c7cc3d48881a2e5575e3ac811highdetectShellterLoader sample (CYFIRMA YARA rule)
sha1dd39fafbdba994169991cea092c6428e1d3b1539highdetectShellterLoader sample (CYFIRMA YARA rule)
md5d3cea61538aa5030e90a1d38cca762b4highdetectShellterLoader sample (CYFIRMA YARA rule)
domainwss.scriptlab.cchighdetectC2 / payload-staging websocket endpoint
urlwss.scriptlab.cc/api/splitChanges/850ec405mediumdetectC2 websocket path (YARA string)
mutexChromeProcessSingletonStartup!highhuntSingle-instance guardrail (not CQL-queryable, see s7)
mutexOMADM_NAMED_MUTEXhighhuntSingle-instance guardrail (not CQL-queryable, see s7)
behaviorchrome.exe at C:\Users\<USER>\AppData\Local\Chromium\Application\chrome.exehighdetectMasquerading path — Q1
behaviormsedge.exe at C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with --no-first-run --no-default-browser-checkmediumdetectLegitimate install path; flag+parent anomaly needed — Q2
behaviorC:\Windows\system32\BackgroundTaskHost.exe -ServerName:BackgroundTaskHost.WebAccountProviderhighdetectMasquerade when path is NOT System32 — Q3
behaviorC:\Windows\System32\RuntimeBroker.exe -EmbeddinghighdetectMasquerade when path is NOT System32 — Q3
file path...\AppData\Local\Chromium\User Data\Crashpad\settings.datmediumhuntChromium user-data artifact mimicry (not CQL-queryable, see s7)
file path...\AppData\Local\Chromium\User Data\BrowserMetrics\BrowserMetrics-6AB8F3B2-122C.pmamediumhuntChromium user-data artifact mimicry (not CQL-queryable, see s7)
file path...\AppData\Local\Chromium\User Data\lockfilemediumhuntChromium user-data artifact mimicry (not CQL-queryable, see s7)
file path...\AppData\Local\Chromium\User Data\VariationsmediumhuntChromium user-data artifact mimicry (not CQL-queryable, see s7)
domain (legitimate — do not block)sb.scorecardresearch.comlowcontext onlyLegitimate comScore analytics infrastructure. CYFIRMA describes ShellterLoader as masquerading as/abusing traffic to this domain during payload retrieval. Never ship as prevent/block — Q8
05

Affected Surface & Telemetry Matrix

SurfaceRequired TelemetryPriorityGap Risk
Windows endpoints (initial loader execution)Process creation with image path, command line and parent
CrowdStrike: ProcessRollup2 · SentinelOne: Process Creation · Defender: DeviceProcessEvents		CriticalLow — masquerading paths are specific and well covered by Q1–Q5
DNS / network egressDNS lookups with the requesting process
CrowdStrike: DnsRequest · SentinelOne: DNS Resolved · Defender: DeviceEvents (DnsQueryResponse), see the Q6 and Q8 assumptions		HighLow — scriptlab.cc is a dedicated, low-noise domain
Process-memory / injection layerNo Falcon CQL event documented for mutex creation, RWX allocation, or remote-thread creation (see s7). The SentinelOne and Defender tabs do not query this layer either.HighHigh — in Falcon this layer depends on the on-sensor ML/IOA engine, not LogScale-queryable telemetry
Downstream / second-stage payloadUnknown — the single available source does not describe the staged payloadCriticalUnassessed — treat any confirmed hit as a precursor to a broader compromise, not an isolated event
06

ATT&CK Mapping

TacticTechniqueObserved BehaviorQuery / Control
ExecutionT1047 — Windows Management InstrumentationListed in CYFIRMA's TTP table; not elaborated with atomic detail in the attack-method narrative for this sampleBehavioral (gap) — pair with your existing WMI-execution hunts
ExecutionT1059 — Command and Scripting InterpreterListed in CYFIRMA's TTP table; not elaborated with atomic detailBehavioral (gap)
ExecutionT1129 — Shared ModulesReflective/in-memory loading of staged componentsBehavioral (gap, s7)
Defense EvasionT1027.002 — Obfuscated Files or Information: Software PackingExecution chain designed to reduce visibility and complicate static analysisBehavioral (gap)
Defense EvasionT1036.005 — Masquerading: Match Legitimate Name or Locationchrome.exe / msedge.exe / BackgroundTaskHost.exe / RuntimeBroker.exe path and name mimicry (analyst-mapped from the reported strings)Q1, Q2, Q3, Q4, Q5
Defense EvasionT1218 — System Binary Proxy ExecutionMasquerading as legitimate Chromium, Edge, and Windows system binariesQ1–Q5
Defense EvasionT1497 — Virtualization/Sandbox EvasionMutex-gated single-instance check plus "basic environment checks"; may alter behavior or terminateBehavioral (gap, s7)
Defense EvasionT1564 — Hide ArtifactsChromium user-data artifact mimicry (settings.dat, lockfile, Variations, BrowserMetrics file)Behavioral (gap, s7)
Defense EvasionT1055 — Process Injection (analyst-added)"Memory and thread manipulation consistent with code injection into alternate process contexts" per CYFIRMAQ3, Q4 (masquerade precursor only); injection itself is a gap (s7)
DiscoveryT1012 / T1033 / T1057 / T1082 / T1083 / T1518.001Listed in CYFIRMA's TTP table as generic environment/host checks; no atomic command or registry key publishedBehavioral (gap, s7) — pair with existing discovery-chain hunts
CollectionT1185 — Browser Session HijackingListed in CYFIRMA's TTP table under Collection; not elaborated in the attack-method narrative for this sampleNot built — no corroborating atomic detail, flagged for completeness only
Command and ControlT1071 / T1071.001 — Application Layer Protocol / Web ProtocolsWebsocket C2 to scriptlab.ccQ6
Command and ControlT1573 — Encrypted Channelwss:// (TLS) C2 channelQ6
Command and ControlT1102.002 — Web Service: Bidirectional Communication (analyst-added, low confidence)Traffic masquerading as/abusing the legitimate sb.scorecardresearch.com during payload retrievalQ8 — hunt/context only, legitimate domain, never block
ImpactT1485 / T1486 — Data Destruction / Data Encrypted for ImpactListed in CYFIRMA's weekly TTP table; the ShellterLoader attack-method narrative describes only delivery/staging behavior, not destructive or encryption impact. This pair appears to reflect the week's broader ransomware coverage (Qilin, The Gentlemen) rather than ShellterLoader itself.Not corroborated for this family — excluded from scope, no hunt built
07

Native Audit-Log Hunts (non-CQL)

The behaviors below are described in the source reporting but are not exposed as queryable fields in Falcon's documented LogScale event model (crowdstrike-logscale-v3 reference set). They are listed here as honest gaps with the best available compensating approach, rather than being forced into a fabricated CQL field.

  • Mutex creation (ChromeProcessSingletonStartup!, OMADM_NAMED_MUTEX): Falcon's CQL/LogScale event model does not expose named kernel-object creation as a queryable event. This guardrail is visible to Falcon's on-sensor ML/behavioral detection engine but not as raw telemetry you can hunt with CQL. Validate presence of these objects via Falcon Real Time Response (RTR) on hosts already flagged by Q1–Q5, or a live-response handle enumeration during IR.
  • Reflective loading / in-memory execution / thread or memory manipulation consistent with injection: no Falcon CQL field directly exposes RWX memory allocations or remote-thread creation. Rely on Falcon's built-in IOA/ML detections (console-side, not LogScale-queryable) for this layer, and use RTR to inspect the loaded-module list of hosts already flagged by Q1–Q5 for threads whose start address does not map to a known module.
  • Chromium user-data artifact mimicry (settings.dat, lockfile, Variations, BrowserMetrics-6AB8F3B2-122C.pma under a masquerading User Data tree): these are non-executable data-file writes. Falcon's documented event catalog (PeFileWritten, NewExecutableWritten, ZipFileWritten) covers executables and archives, not arbitrary data files, so this artifact set is not reliably CQL-queryable today. If your environment layers Sysmon, hunt Event ID 11 (FileCreate) for these exact filenames under a path that fails the FilePath anchoring used in Q1.
  • Environment / host-suitability checks (generic discovery before ShellterLoader decides whether to run): the source reporting describes these only generically — no atomic registry key, command, or API was published. Treat as a documented gap rather than building a hunt on an assumption; pair any Q1–Q5 hit with the discovery-chain hunts already in your library (for example systeminfo.exe/tasklist.exe/wmic.exe spawned immediately after a masquerading process).
08

Hunt Queries: CrowdStrike CQL, SentinelOne PowerQuery and Defender XDR KQL

Show all queries in
Pick your tenant's cloud first — every "Open in Falcon" button below uses this selection.
Q1 · chrome.exe masquerading from a user-writable Chromium path
CONF HIGHFP LOWCOST LOW

Looks for: a basename matching chrome.exe running from AppData\Local\Chromium\Application — a user-writable path, not a real browser install location — with the reported suppression flags. FP: low; legitimate Google Chrome installs under Program Files/Google\Chrome\Application, not a user-profile Chromium folder.

Validation: schema-aligned, static-reviewedAutomated: harness-generatedEquivalence: equivalent-with-schema-assumptionsProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
  • PowerQuery: A browser launched by a process the agent never observed starting is not captured.
  • PowerQuery assumes: tgt.process.image.sha256 is the Process Creation hash field that the independent pySigma backend maps; whether a tenant populates it is unproven, which the readiness test shows.
  • PowerQuery assumes: String matches is case-insensitive by default, which reproduces the CQL /i intent.
  • KQL – Defender XDR: A process the sensor did not observe starting is not captured.
  • KQL – Defender XDR assumes: FolderPath holds the full image path of the created process.
  • KQL – Defender XDR assumes: Both suppression flags are matched as plain substrings.
// HUNT: chrome.exe executing from a user-writable Chromium path (masquerading)
// MITRE: T1036.005, T1218  CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^chrome(\.exe)?$/i
| FilePath=/\\AppData\\Local\\Chromium\\Application\\/i
| CommandLine=/--no-first-run|--no-default-browser-check/i
| table([ComputerName, UserName, ParentBaseFileName, FilePath, CommandLine, SHA256HashData], limit=200)
Q2 · msedge.exe suppression flags from a non-interactive parent
CONF MEDFP MEDCOST LOW

Looks for: msedge.exe launched with --no-first-run --no-default-browser-check by a parent that is not a normal interactive launcher. This hits the real default Edge install path, so path alone cannot discriminate — behavior and lineage carry the signal. FP: medium; deployment/automation tooling (SCCM, Intune, browser test harnesses) legitimately passes these flags.

Validation: schema-aligned, static-reviewedAutomated: harness-generatedEquivalence: equivalent-with-schema-assumptionsProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
  • PowerQuery: A parent the agent did not record leaves src.process.name null, and the negation then keeps the row.
  • PowerQuery assumes: The parent allowlist negation depends on src.process.name being the creator on Process Creation events, which the field model attests.
  • PowerQuery assumes: tgt.process.image.sha256 is the Process Creation hash field that the independent pySigma backend maps; whether a tenant populates it is unproven, which the readiness test shows.
  • KQL – Defender XDR: A process the sensor did not observe starting is not captured.
  • KQL – Defender XDR assumes: A parent the sensor did not record leaves InitiatingProcessFileName empty, and the negation then keeps the row, as the CQL does.
// HUNT: msedge.exe launched with first-run-suppression flags by a non-interactive parent
// MITRE: T1036.005  CONF: medium  FP: medium  COST: low | REQUIRES: ProcessRollup2
// TUNING: exclude known deployment/automation parents (SCCM, Intune, chromedriver.exe, msedgedriver.exe, GPO logon scripts) before promoting beyond hunt
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^msedge(\.exe)?$/i
| CommandLine=/--no-first-run/i
| CommandLine=/--no-default-browser-check/i
| ParentBaseFileName!=/^(explorer|userinit|msedge|RuntimeBroker|SearchApp|StartMenuExperienceHost)\.exe$/i
| table([ComputerName, UserName, ParentBaseFileName, FilePath, CommandLine, SHA256HashData], limit=200)
Q3 · RuntimeBroker.exe / BackgroundTaskHost.exe outside System32
CONF HIGHFP LOWCOST LOW

Looks for: a process named RuntimeBroker.exe or BackgroundTaskHost.exe whose FilePath is not under System32/SysWOW64. Both binaries only ever ship from those directories on a standard Windows build, so a path mismatch is a strong masquerading signal. FP: low.

Validation: schema-aligned, static-reviewedAutomated: harness-generatedEquivalence: equivalent-with-schema-assumptionsProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
  • PowerQuery: A renamed binary that is not named RuntimeBroker or BackgroundTaskHost is outside this predicate.
  • PowerQuery assumes: A null image path satisfies the negation and keeps the row, matching the CQL != behaviour on a missing field.
  • PowerQuery assumes: tgt.process.image.sha256 is the Process Creation hash field that the independent pySigma backend maps; whether a tenant populates it is unproven, which the readiness test shows.
  • KQL – Defender XDR: A renamed binary that is not named RuntimeBroker or BackgroundTaskHost is outside this predicate.
  • KQL – Defender XDR assumes: An empty FolderPath satisfies the negation and keeps the row, matching the CQL != behaviour on a missing field.
// HUNT: RuntimeBroker.exe / BackgroundTaskHost.exe executing outside System32 (masquerading)
// MITRE: T1036.005, T1055, T1218  CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(RuntimeBroker|BackgroundTaskHost)(\.exe)?$/i
| FilePath!=/\\Windows\\(System32|SysWOW64)\\/i
| table([ComputerName, UserName, ParentBaseFileName, FilePath, CommandLine, SHA256HashData], limit=200)
Q4 · RuntimeBroker.exe / BackgroundTaskHost.exe with a non-svchost parent
CONF MEDFP MEDCOST LOW

Looks for: the same two binaries, running from the legitimate System32/SysWOW64 path, but spawned by something other than svchost.exe — the only legitimate launcher for these DCOM-activated services. FP: medium; some AppX/UWP hosting edge cases spawn these via taskhostw.exe or dllhost.exe.

Validation: schema-aligned, static-reviewedAutomated: harness-generatedEquivalence: equivalent-with-schema-assumptionsProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
  • PowerQuery: Hollowing or injection into a correctly parented process does not change the creator and is not detected here.
  • PowerQuery assumes: The creator is src.process on Process Creation events, which the field model attests.
  • PowerQuery assumes: tgt.process.image.sha256 is the Process Creation hash field that the independent pySigma backend maps; whether a tenant populates it is unproven, which the readiness test shows.
  • KQL – Defender XDR: A process the sensor did not observe starting is not captured.
  • KQL – Defender XDR assumes: An empty InitiatingProcessFileName keeps the row, as the CQL does.
// HUNT: RuntimeBroker.exe / BackgroundTaskHost.exe with a non-svchost parent
// MITRE: T1036.005, T1055  CONF: medium  FP: medium  COST: low | REQUIRES: ProcessRollup2
// TUNING: baseline legitimate parents in your fleet (svchost.exe is standard; some AppX/UWP hosts spawn via taskhostw.exe/dllhost.exe) before promoting past hunt
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(RuntimeBroker|BackgroundTaskHost)(\.exe)?$/i
| FilePath=/\\Windows\\(System32|SysWOW64)\\/i
| ParentBaseFileName!=/^svchost\.exe$/i
| table([ComputerName, UserName, ParentBaseFileName, FilePath, CommandLine, SHA256HashData], limit=200)
Q5 · Browser suppression-flag combo on a non-browser image
CONF MEDFP MEDCOST LOW

Looks for: the exact --no-first-run --no-default-browser-check flag combo on a process whose basename is not chrome.exe/msedge.exe — a renamed or relocated loader still carrying the same embedded launch string. FP: medium; browser-automation harnesses pass these flags too.

Validation: schema-aligned, static-reviewedAutomated: harness-generatedEquivalence: equivalent-with-schema-assumptionsProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
  • PowerQuery: Other Chromium builds that legitimately accept these flags will match until excluded.
  • PowerQuery assumes: contains is a case-insensitive substring match, so the flags match regardless of case.
  • KQL – Defender XDR: A process the sensor did not observe starting is not captured.
  • KQL – Defender XDR assumes: Both flags are matched as plain substrings anywhere on the command line.
// HUNT: browser first-run-suppression flag combo on a non-browser image (renamed loader)
// MITRE: T1036.005, T1027.002  CONF: medium  FP: medium  COST: low | REQUIRES: ProcessRollup2
// TUNING: exclude approved test/automation harnesses (Selenium, Puppeteer, chromedriver.exe, msedgedriver.exe) that legitimately pass these flags
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/--no-first-run/i
| CommandLine=/--no-default-browser-check/i
| FileName!=/^(chrome|msedge)(\.exe)?$/i
| table([ComputerName, UserName, FileName, FilePath, ParentBaseFileName, CommandLine], limit=200)
Q6 · DNS resolution of the scriptlab.cc C2
CONF HIGHFP LOWCOST LOW

Looks for: DNS resolution of the scriptlab.cc apex or any subdomain (covers the reported wss.scriptlab.cc host). FP: low — dedicated, single-purpose domain.

Validation: schema-aligned, static-reviewedAutomated: harness-generatedEquivalence: equivalent-with-schema-assumptionsProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
  • PowerQuery: A tenant that populates dns.request but not event.dns.request returns no rows; confirm with the readiness test.
  • PowerQuery assumes: event.dns.request is the attested field and dns.request is documented by the vendor; the field model records an unresolved conflict about which one a tenant populates.
  • PowerQuery assumes: The acting process on a DNS event is src.process.
  • KQL – Defender XDR: A lookup answered from the local resolver cache may not generate an event.
  • KQL – Defender XDR: If DnsQueryResponse is not populated on your tenant, the fallback is DeviceNetworkEvents on RemoteUrl, which finds connections to the host rather than lookups.
  • KQL – Defender XDR assumes: Microsoft's DeviceEvents reference does not list ActionType values or the JSON keys inside AdditionalFields. DnsQueryResponse is attested only in community and tooling sources, and the key that holds the queried name is DnsQueryString in some of them and QueryName in others; the query reads whichever is present.
  • KQL – Defender XDR assumes: Run the readiness test first: it prints the raw AdditionalFields so you can confirm the key on your tenant before trusting a zero-row result.
// HUNT: DNS resolution of the ShellterLoader scriptlab.cc C2 infrastructure
// MITRE: T1071.001, T1573  CONF: high  FP: low  COST: low | REQUIRES: DnsRequest
#event_simpleName=DnsRequest
| DomainName=/(^|\.)scriptlab\.cc$/i
| table([ComputerName, ContextBaseFileName, DomainName, aid], limit=200)
Q7 · Known ShellterLoader sample hash execution
CONF HIGHFP LOWCOST LOW

Looks for: execution of the published SHA-256, SHA1, or MD5 for the sample CYFIRMA analyzed. Exact match — promote straight to a Custom IOC (Detect) per s9/s11.

Validation: schema-aligned, static-reviewedAutomated: harness-generatedEquivalence: equivalent-with-schema-assumptions, telemetry-gapProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
  • PowerQuery: The CQL also matches SHA1 dd39fafbdba994169991cea092c6428e1d3b1539 and MD5 d3cea61538aa5030e90a1d38cca762b4. They are not queried in this tab: hunt them on the CQL tab, or add arms for tgt.process.image.sha1 and tgt.process.image.md5 once a readiness test shows your tenant populates them.
  • PowerQuery: If the SHA256 field is unpopulated the query returns nothing, which is indistinguishable from a clean estate.
  • PowerQuery assumes: tgt.process.image.sha256 is the Process Creation hash field that the independent pySigma backend maps; whether a tenant populates it is unproven, which the readiness test shows.
  • PowerQuery assumes: The hash is stored lowercase, so equality is used.
  • KQL – Defender XDR: A repacked sample with a different hash is not caught; Q1 to Q5 cover the behaviour.
  • KQL – Defender XDR assumes: SHA256 can be empty on some events; the SHA1 and MD5 branches cover that.
// HUNT: known ShellterLoader sample hash execution
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| SHA256HashData=/^594033ed58e27b42bb1bef7e5b21eac87f0d660c7cc3d48881a2e5575e3ac811$/i OR SHA1HashData=/^dd39fafbdba994169991cea092c6428e1d3b1539$/i OR MD5HashData=/^d3cea61538aa5030e90a1d38cca762b4$/i
| table([ComputerName, UserName, FileName, FilePath, CommandLine, SHA256HashData, SHA1HashData, MD5HashData], limit=200)
Q8 · sb.scorecardresearch.com from a non-browser process (hunt-only, legitimate domain)
CONF LOWFP HIGHCOST LOW

sb.scorecardresearch.com is LEGITIMATE comScore analytics infrastructure, embedded on countless benign sites. Never promote this to a block/prevent list. CYFIRMA's narrative describes ShellterLoader masquerading as, or abusing, traffic to this domain during payload retrieval. This query is context/correlation only — fire it alongside Q1–Q5 hits, never on its own.

Validation: schema-aligned, static-reviewedAutomated: harness-generatedEquivalence: equivalent-with-schema-assumptionsProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
  • PowerQuery: Embedded browsers and electron apps resolve this domain legitimately and will match until excluded.
  • PowerQuery assumes: The acting process on a DNS event is src.process.
  • PowerQuery assumes: event.dns.request carries the same attestation caveat as the DNS query above.
  • KQL – Defender XDR: A lookup answered from the local resolver cache may not generate an event.
  • KQL – Defender XDR: If DnsQueryResponse is not populated on your tenant, the fallback is DeviceNetworkEvents on RemoteUrl, which finds connections to the host rather than lookups.
  • KQL – Defender XDR assumes: Microsoft's DeviceEvents reference does not list ActionType values or the JSON keys inside AdditionalFields. DnsQueryResponse is attested only in community and tooling sources, and the key that holds the queried name is DnsQueryString in some of them and QueryName in others; the query reads whichever is present.
  • KQL – Defender XDR assumes: Run the readiness test first: it prints the raw AdditionalFields so you can confirm the key on your tenant before trusting a zero-row result.
// HUNT: sb.scorecardresearch.com contacted by a non-browser process (payload-retrieval channel per CYFIRMA reporting)
// MITRE: T1102.002  CONF: low  FP: high  COST: low | REQUIRES: DnsRequest
// TUNING: sb.scorecardresearch.com is LEGITIMATE comScore analytics infrastructure; this is a visibility/context query only, never a block-list candidate -- correlate hits with Q1-Q5 before treating as meaningful, and exclude all known browser processes plus any approved analytics/telemetry agent
#event_simpleName=DnsRequest
| DomainName=/(^|\.)scorecardresearch\.com$/i
| ContextBaseFileName!=/^(chrome|msedge|firefox|brave|opera|iexplore)\.exe$/i
| table([ComputerName, ContextBaseFileName, DomainName, aid], limit=200)
09

Detection Rules by Platform

CrowdStrike: Custom IOA

IOA NamePatternExclusionsDeployment
LOADER — Chromium path masqueradechrome.exe from AppData\Local\Chromium\ApplicationApproved portable/dev Chromium hash allowlist, if any exists in your fleetPromote Q1 → Custom IOA (Detect, High)
LOADER — System32 binary masqueradeRuntimeBroker.exe / BackgroundTaskHost.exe outside System32None — System32 is immutable under standard buildsPromote Q3 → Custom IOA (Detect, High)
LOADER — known sample hashSHA256 / SHA1 / MD5 match (s4)NoneQ7 → Custom IOC (Detect only — single-source, do not set Prevent/Critical until corroborated)

Do not create a Custom IOA/IOC for sb.scorecardresearch.com. It is legitimate infrastructure; Q8 stays a hunt/context query only.

SentinelOne: custom detection rules

RuleSource queryRun asNotes
LOADER — Chromium path masqueradeQ1, PowerQuery tabScheduled custom detection ruleBind entities so the alert names the host instead of "Unknown Device"
LOADER — System32 binary masqueradeQ3, PowerQuery tabScheduled custom detection ruleBind entities so the alert names the host instead of "Unknown Device"

Create the rule with POST /web/api/v2.1/cloud-detection/rules, queryType: "scheduled" and queryLang: "2.0", with the query in data.scheduledParams.query. Use 2.0 operator spellings: a rule written with the 1.0 token ContainsCIS was accepted and never fired on a tenant. The API does not warn, so lint the body before deploying.

Microsoft Defender: custom detection rules

RuleSource queryRun asNotes
LOADER — Chromium path masqueradeQ1, KQL – Defender XDR tabCustom detection rule, alert only, every hourThe query returns Timestamp, ReportId and DeviceId, which Microsoft recommends for Defender for Endpoint tables so alerts carry the device group scope and the process tree. Remove the Timestamp filter and the final sort and take before saving the rule: the service applies the rule's lookback itself
LOADER — System32 binary masqueradeQ3, KQL – Defender XDR tabCustom detection rule, alert only, every hourThe query returns Timestamp, ReportId and DeviceId, which Microsoft recommends for Defender for Endpoint tables so alerts carry the device group scope and the process tree. Remove the Timestamp filter and the final sort and take before saving the rule: the service applies the rule's lookback itself
LOADER — known sample hashQ7, KQL – Defender XDR tabIndicator, not a rule (s10)Import at Audit first, as the pack ships every indicator at detect unless s10 says otherwise

Q2, Q4, Q5, Q6 and Q8 stay a hunt in this pack, not a rule. A rule can generate only 150 alerts per run. Continuous (NRT) frequency needs a single table and no comment lines, so delete the generated comment header from the query first.

10

Machine-Readable IOC Appendix

Falcon IOC Management CSVbulk import — detect only
type,value,action,severity,expiration,description,tags
sha256,594033ed58e27b42bb1bef7e5b21eac87f0d660c7cc3d48881a2e5575e3ac811,detect,high,2027-04-01,ShellterLoader sample (CYFIRMA 2026-10-01),campaign:ShellterLoader
sha1,dd39fafbdba994169991cea092c6428e1d3b1539,detect,high,2027-04-01,ShellterLoader sample (CYFIRMA 2026-10-01),campaign:ShellterLoader
md5,d3cea61538aa5030e90a1d38cca762b4,detect,high,2027-04-01,ShellterLoader sample (CYFIRMA 2026-10-01),campaign:ShellterLoader
domain,wss.scriptlab.cc,detect,medium,2026-11-16,ShellterLoader C2 / payload-staging infrastructure (CYFIRMA 2026-10-01),campaign:ShellterLoader
Microsoft Defender indicators CSVSettings, Endpoints, Indicators, Import: audit only
indicatorType,indicatorValue,action,title,description,expirationTime,severity,recommendedActions,rbacGroups,category,mitretechniques,GenerateAlert
FileSha256,594033ed58e27b42bb1bef7e5b21eac87f0d660c7cc3d48881a2e5575e3ac811,Audit,ShellterLoader sample,ShellterLoader sample (CYFIRMA 2026-10-01),2027-04-01T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
FileSha1,dd39fafbdba994169991cea092c6428e1d3b1539,Audit,ShellterLoader sample,ShellterLoader sample (CYFIRMA 2026-10-01),2027-04-01T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
DomainName,wss.scriptlab.cc,Audit,ShellterLoader C2 / payload-staging infrastructure,ShellterLoader C2 / payload-staging infrastructure (CYFIRMA 2026-10-01),2026-11-16T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True

Column names and allowed values are from Microsoft's documented parameter table. Left out because this block maps only SHA-1, SHA-256, IPv4, domain and URL indicators: md5 1. Check each expirationTime before importing: an indicator whose date has passed is already expired. Download the sample CSV from the Import page to confirm the column order before a bulk import. Each file takes at most 500 indicators. Learn describes the import per entity type, so if a mixed file is rejected, split it by indicatorType. An imported indicator does nothing unless the matching Advanced features are on (for example Custom network indicators and Allow or block file).

SentinelOne IOC importnot included

This pack does not ship a SentinelOne import block: the import format could not be verified against SentinelOne's own documentation. Export a sample from your console and the block can be added with confidence.

Behavioral Signatureshunt pivots — not CQL-queryable
# Guardrail mutexes (single-instance check; see s7)
ChromeProcessSingletonStartup!
OMADM_NAMED_MUTEX
# Masquerading paths / command lines (YARA strings, CYFIRMA 2026-10-01)
C:\Users\<USER>\AppData\Local\Chromium\Application\chrome.exe  --no-first-run --no-default-browser-check
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe  --no-first-run --no-default-browser-check
C:\Windows\system32\BackgroundTaskHost.exe -ServerName:BackgroundTaskHost.WebAccountProvider
C:\Windows\System32\RuntimeBroker.exe -Embedding
# Chromium user-data artifact mimicry
...\AppData\Local\Chromium\User Data\Crashpad\settings.dat
...\AppData\Local\Chromium\User Data\BrowserMetrics\BrowserMetrics-6AB8F3B2-122C.pma
...\AppData\Local\Chromium\User Data\lockfile
...\AppData\Local\Chromium\User Data\Variations
# Technique (not CQL-queryable; Falcon on-sensor ML/IOA only -- see s7)
Reflective loading / in-memory execution; memory and thread manipulation
consistent with code injection into another process's context
Network & C2DNS hunt — one domain is NOT a block candidate
# C2 / payload staging -- safe to hunt and block
wss.scriptlab.cc
wss.scriptlab.cc/api/splitChanges/850ec405
# LEGITIMATE third-party infrastructure referenced in the reporting -- DO NOT BLOCK
# ShellterLoader masquerades as/abuses traffic to this domain during payload retrieval.
sb.scorecardresearch.com
Single-Source Promotion Checklistbefore raising severity
# Do NOT promote any indicator in this pack to Prevent or Critical until:
1. A second independent source corroborates ShellterLoader by name, hash,
   mutex, or C2 infrastructure (none found as of 2026-10-02)
2. Q2/Q4/Q5/Q8 have been baselined for 7-14 days in your tenant (s11)
3. Any confirmed hit has been treated as a precursor and the environment
   has been widened-hunted for an unknown second-stage payload (s14)
11

Detection Validation Gates

  • Telemetry ready: confirm ProcessRollup2 is capturing FilePath and CommandLine, and that DnsRequest is flowing, before relying on Q1–Q8.
  • Benign baseline: run Q2, Q4, Q5, and Q8 for 7–14 days; catalog legitimate automation/deployment parents and any approved analytics agents; build exclusions before promoting past hunt.
  • Positive tests: stage a disposable test binary named chrome.exe under a throwaway AppData\Local\Chromium\Application path to confirm Q1 fires; launch msedge.exe --no-first-run --no-default-browser-check from a non-interactive script to confirm Q2 fires only with the parent anomaly engaged.
  • Single-source caveat: do not promote any indicator to Prevent/Critical until a second independent source corroborates ShellterLoader; re-run this pipeline's provenance and coverage gates on any re-hunt before promotion.
  • Promotion: Q1, Q3, and Q7 → Custom IOA/IOC at Detect first; Q2/Q4/Q5 stay hunt-only until baselined; Q8 never promotes beyond hunt/context.
12

Hardening — Tiered & Deployable

Immediate (this week)
  • Import the detect-only IOC set (M1049 Antivirus/Antimalware): load the s10 Falcon CSV (hashes + scriptlab.cc) at action=detect; do not set Prevent/Critical on a single source.
  • Confirm Falcon behavioral prevention is enabled (M1040 Behavior Prevention on Endpoint): verify process-injection and reflective-loading ML/IOA detections are active in your prevention policy — this is the only layer that currently covers the mutex-guardrail and injection steps (s7).
  • Block the dedicated C2 domain at DNS/proxy (M1031 Network Intrusion Prevention): deny scriptlab.cc and subdomains. Never add sb.scorecardresearch.com to this block list — it is legitimate third-party infrastructure.
Near term (1–4 weeks)
  • Application control deny rules (M1038 Execution Prevention): block execution of chrome.exe/msedge.exe-named binaries from user-writable AppData paths, and RuntimeBroker.exe/BackgroundTaskHost.exe-named binaries from anywhere outside System32/SysWOW64, via AppLocker or WDAC (CIS Microsoft Windows Benchmark application-control guidance; Microsoft Security Baseline AppLocker recommendations).
  • Audit SeDebugPrivilege assignment (M1026 Privileged Account Management): review and restrict which accounts/processes can acquire debug rights, as defense-in-depth against the injection step described in s7.
Strategic (1–3 months)
  • Formal WDAC code-integrity policy (M1038 Execution Prevention) fleet-wide, moving beyond the targeted deny rules above to full allowlisting of signed, approved binaries.
  • Reduce the phishing delivery surface (M1017 User Training): CYFIRMA's own tactical recommendations call for password resets and MFA verification on any confirmed hit — fold this into standard phishing-awareness training given the unknown second-stage payload.
  • Periodic RTR sweep for the two named mutexes (⚠ best-practice, no formal benchmark): schedule a recurring Falcon Real Time Response check for ChromeProcessSingletonStartup! / OMADM_NAMED_MUTEX and anomalous thread context on hosts previously flagged by Q1–Q5, since this layer has no CQL-queryable equivalent.
13

Deployable Playbooks

1 · AppLocker deny rules for masquerading binaries

Prerequisites: Application Identity service (AppIDSvc) running; GPO/AppLocker infrastructure in place; test in Audit enforcement mode before switching to Enforce.
Reboot required: No — apply with gpupdate /force and an AppIDSvc restart.
Rollback: Remove the two deny rules (or switch enforcement back to Audit) and run gpupdate /force.

<!-- AppLocker path-rule fragment: deny browser-named EXE from a user-writable Chromium path -->
<FilePathRule Id="b1d6e2b2-23b4-4b9a-9a1a-ShellterLoaderQ1" Name="Deny chrome.exe-named binary under user AppData Chromium path"
  Description="Blocks masquerading chrome.exe per ShellterLoader reporting (CYFIRMA 2026-10-01)"
  UserOrGroupSid="S-1-1-0" Action="Deny">
  <Conditions>
    <FilePathCondition Path="%LOCALAPPDATA%\Chromium\Application\chrome.exe" />
  </Conditions>
</FilePathRule>

<!-- Deny RuntimeBroker.exe / BackgroundTaskHost.exe anywhere except the real System32 locations -->
<FilePathRule Id="c2e7f3c3-34c5-4c0b-9b2b-ShellterLoaderQ3" Name="Deny RuntimeBroker/BackgroundTaskHost outside System32"
  Description="Blocks masquerading RuntimeBroker.exe/BackgroundTaskHost.exe per ShellterLoader reporting"
  UserOrGroupSid="S-1-1-0" Action="Deny">
  <Conditions>
    <FilePathCondition Path="*\RuntimeBroker.exe" />
    <FilePathCondition Path="*\BackgroundTaskHost.exe" />
  </Conditions>
  <Exceptions>
    <FilePathCondition Path="%WINDIR%\System32\RuntimeBroker.exe" />
    <FilePathCondition Path="%WINDIR%\SysWOW64\RuntimeBroker.exe" />
    <FilePathCondition Path="%WINDIR%\System32\BackgroundTaskHost.exe" />
    <FilePathCondition Path="%WINDIR%\SysWOW64\BackgroundTaskHost.exe" />
  </Exceptions>
</FilePathRule>

2 · Push the detect-only IOC set via the Falcon Indicator API

Prerequisites: Falcon API client with the iocs:write scope.
Reboot required: No.
Rollback: Delete the imported indicators from Endpoint Security → IOC Management, or call the delete-indicator endpoint with the same IDs.

# PowerShell -- import the s10 hash IOCs at action=detect (never prevent, single source)
$headers = @{ Authorization = "Bearer $FalconToken"; "Content-Type" = "application/json" }
$body = @{
  indicators = @(
    @{ type="sha256"; value="594033ed58e27b42bb1bef7e5b21eac87f0d660c7cc3d48881a2e5575e3ac811"; action="detect"; severity="high"; platforms=@("windows") },
    @{ type="sha1";   value="dd39fafbdba994169991cea092c6428e1d3b1539"; action="detect"; severity="high"; platforms=@("windows") },
    @{ type="md5";    value="d3cea61538aa5030e90a1d38cca762b4"; action="detect"; severity="high"; platforms=@("windows") },
    @{ type="domain"; value="wss.scriptlab.cc"; action="detect"; severity="medium"; platforms=@("windows") }
  )
} | ConvertTo-Json -Depth 4
Invoke-RestMethod -Method Post -Uri "https://api.crowdstrike.com/iocs/entities/indicators/v1" -Headers $headers -Body $body

3 · Block the scriptlab.cc C2 at the proxy (Squid example)

Prerequisites: proxy/firewall admin access; deploy in log/monitor mode first to confirm no legitimate traffic references the domain.
Reboot required: No — reload the proxy configuration.
Rollback: Remove the ACL line and reload the proxy configuration.

# /etc/squid/shellterloader.acl
acl shellterloader_c2 dstdomain .scriptlab.cc
http_access deny shellterloader_c2
# Do NOT add sb.scorecardresearch.com here -- it is legitimate comScore infrastructure.
14

Containment Runbook

PhaseActionsOwnerEvidence
IsolateNetwork-contain any host matching Q1/Q3/Q4/Q5/Q7; capture volatile memory before any reboot (reflective loading leaves minimal disk artifact)SOC / IRFalcon detections, memory image
Isolate: by platformCrowdStrike: network-contain the host. SentinelOne: network quarantine (Disconnect from Network; confirm the label in your console version). Microsoft Defender: Isolate device (full network isolation). Keep the host powered on for memory capture on all of them.SOC / IRFalcon detections, memory image
EradicateRemove the masquerading binary and any Chromium user-data artifact tree created outside a real browser install. Treat the environment as exposed to an unknown second-stage payload (the single available source does not describe it) and widen the hunt rather than closing the case on loader removal aloneIRRemoved artifacts, hunt results across Q1–Q8
Hunt replayRun the s7 RTR-based manual checks for the two named mutexes and for threads with no backing module on the affected host; expand Q6/Q8 across the environment, not just the flagged hostIRRTR output, DNS logs
RecoverRebuild hosts where a second-stage payload cannot be ruled out; re-image rather than clean where injection into RuntimeBroker.exe/BackgroundTaskHost.exe is confirmed; deploy the s13 AppLocker rules before returning the host to productionEndpointRebuild records
15

Detection Coverage Map

TechniqueBehaviorCQLIOACrowdStrike coverageSentinelOneDefender XDR
T1036.005 / T1218Masquerading as chrome/msedge/RuntimeBroker/BackgroundTaskHostQ1, Q2, Q3, Q4, Q5Q1, Q3GoodGood, with assumptionsGood, with assumptions
T1071.001 / T1573scriptlab.cc websocket/TLS C2Q6domain IOC (s9)GoodGood, with assumptionsGood, with assumptions
T1102.002sb.scorecardresearch.com traffic masquerade (legitimate domain, hunt-only)Q8— (never promoted)Partial — deliberately capped at hunt/contextPartial: same limit as CrowdStrikePartial: same limit as CrowdStrike
(known sample)SHA256 / SHA1 / MD5 executionQ7Q7GoodPartial: Q7 telemetry gapGood, with assumptions
T1497Mutex-gated sandbox/environment evasion——GAP (s7)GAPGAP
T1055Process injection into RuntimeBroker/BackgroundTaskHostQ3, Q4 (masquerade precursor only)—Partial — precursor covered, injection itself not CQL-visible (s7)Partial: same limit as CrowdStrikePartial: same limit as CrowdStrike
T1129 / T1027.002Reflective in-memory loading / packing——GAP (s7)GAPGAP
T1564Chromium user-data artifact mimicry——GAP (s7 — Sysmon EID 11 suggested)GAPGAP
T1012 / T1033 / T1057 / T1082 / T1083 / T1518.001Generic environment/host checks——GAP — no atomic detail published; pair with existing discovery-chain huntsGAPGAP
T1185, T1485, T1486Listed in vendor TTP table, not corroborated by the attack-method narrative for this family——Not in scope — excluded, see s6Not in scopeNot in scope

Validation: the masquerading + C2 layer is well covered and promotable at Detect. The memory/injection layer and the generic-discovery TTPs remain gaps pending either richer telemetry (RTR/Sysmon) or a second independent source. Nothing in this pack should be promoted to Prevent/Critical on single-source reporting alone.

16

Hunt Summary Ticket

TITLE:      ShellterLoader - Windows downloader/dropper with reflective loading and process masquerade
SEVERITY:   High (loader risk; unknown second-stage payload) - Confidence Medium (single source, CYFIRMA, no independent corroboration found)
SCOPE:      Windows endpoints; DNS/network egress; downstream blast radius unassessed pending second-stage identification
HYPOTHESIS: ShellterLoader enforces single-instance via two named mutexes, masquerades as chrome.exe/msedge.exe/
            BackgroundTaskHost.exe/RuntimeBroker.exe to blend in, reflectively loads and stages a second payload over
            a scriptlab.cc websocket channel (possibly fronted through legitimate sb.scorecardresearch.com traffic),
            then hands off to an unknown follow-on payload
QUERIES:    Q1 Chromium path masquerade | Q2 Edge flag+parent anomaly | Q3 System32 path anomaly |
            Q4 RuntimeBroker/BackgroundTaskHost parent anomaly | Q5 suppression-flag combo on renamed binary |
            Q6 scriptlab.cc C2 DNS | Q7 known hash | Q8 scorecardresearch.com hunt-only (legitimate, never block)
DO FIRST:   Run Q1, Q3, Q6, Q7 (lowest FP); baseline Q2/Q4/Q5/Q8 for 7-14 days before promoting
GAPS:       mutex creation, reflective-load/injection memory layer, generic discovery TTPs, Chromium artifact-file
            writes -- all behavioral-only, see s7/s15
ACTIONS:    Import the detect-only IOC CSV (s10); do not set any indicator to Prevent/Critical pending a second
            source; treat any hit as a precursor to a broader compromise, not an isolated event
OWNER:      <analyst>
VERSION:    v1.2 · 2026-10-09
17

Changelog

v1.22026-10-09Added Microsoft Defender KQL tabs to Q1-Q8 and a language switch above the queries (CrowdStrike CQL, SentinelOne PowerQuery or Defender KQL for every card at once), with a SentinelOne console box and a Defender portal picker. Added detection rules by platform, a Defender indicators CSV, an isolation row and per-platform coverage columns. Telemetry wording is now platform-neutral. The CrowdStrike and SentinelOne queries are unchanged; the SentinelOne readiness tests now check that each field is populated, and the Q7 note says plainly that only the SHA-256 is queried.
v1.12026-10-06Added SentinelOne PowerQuery tabs to Q1-Q8: SIEM Query Rosetta release 0.1.0 (public-beta; static-reviewed translations). CQL unchanged.
v1.02026-10-02Initial HuntPack. Built from CYFIRMA's Weekly Intelligence Report (1 Oct 2026), the only source located for ShellterLoader; independent corroboration was searched for (threat name, sample hashes, mutex names) and not found. 8 CQL queries covering masquerading paths (chrome.exe/msedge.exe/RuntimeBroker.exe/BackgroundTaskHost.exe), the scriptlab.cc C2 domain, and known sample hashes; all Falcon-import indicators ship as action=detect pending a second independent source. sb.scorecardresearch.com is documented as legitimate third-party infrastructure referenced in the reporting and is explicitly excluded from any block/prevent action. Reflective loading, process injection, named-mutex creation, and generic host/environment-check behaviors are flagged as detection gaps because Falcon's documented LogScale event model does not expose them as queryable telemetry; see s7 and s15.
18

References

TierSourceUsed ForAccess Date
1CYFIRMA — Weekly Intelligence Report, 1 Oct 2026Full technical profile, attack method, IOCs, YARA rule, MITRE ATT&CK mapping2026-10-02
RefMITRE ATT&CK T1036.005 — Masquerading: Match Legitimate Name or LocationTechnique mapping (Q1–Q5)2026-10-02
RefMITRE ATT&CK T1055 — Process InjectionTechnique mapping (s7, Q3/Q4)2026-10-02
RefMITRE ATT&CK T1071.001 — Application Layer Protocol: Web ProtocolsTechnique mapping (Q6)2026-10-02

No independent corroboration of "ShellterLoader" by this name was found as of 2026-10-02 (searched: threat name, sample hashes, named mutexes). A search for the commercial Shellter AV-evasion framework surfaced an unrelated 2025 infostealer campaign that abused a leaked license — a different tool, timeframe, and infrastructure, excluded from this pack. This pack therefore ships as single-source; see s2 and s11 for the operational implications.

Generated: 2026-10-02 · HuntPack pipeline v8.28.26 · Single-source pack (CYFIRMA only) — all Falcon-import indicators ship as action=detect.