SprySOCKS Windows Variants — WIN_DRV / WIN_PLUS (FishMonger)

Looks for: a PE / driver file written to a user/temp/ProgramData path (rather than the normal driver store) — the WIN_DRV encrypted driver / DriverLoader drop, caught before the rootkit hides it. FP: some installers/AV stage drivers in non-standard paths — exclude known software-distribution writers and signed vendor processes.

// HUNT: kernel driver / encrypted .sys|.dat written to non-standard path (pre-rootkit)
// MITRE: T1014, T1543.003 | CONF: high  FP: med  COST: low
// REQUIRES: PeFileWritten / file-write telemetry
// FALSE POSITIVES: legit driver installers (exclude signed vendor writers, SCCM/Intune staging)
#event_simpleName=/PeFileWritten|NewExecutableWritten/
| TargetFileName=/\.(sys|dat)$/i
| TargetFileName=/\\(Temp|AppData|ProgramData|Users\\Public|Windows\\Tasks)\\/i
| TargetFileName!=/\\Windows\\System32\\DriverStore\\/i
| table([@timestamp, ComputerName, UserName, ImageFileName, TargetFileName, SHA256HashData], limit=200)

Looks for: installation of a kernel-mode service or a driver load referencing a .sys outside the trusted driver store — the WIN_DRV rootkit install (and the BYOVD pattern of loading an unsigned/vulnerable driver to reach kernel). FP: legitimate driver/EDR/virtualization installs — baseline known service names + image paths and alert on first-seen.

// HUNT: kernel-mode service install / driver load from untrusted path (BYOVD / rootkit)
// MITRE: T1543.003, T1068, T1014 | CONF: high  FP: med  COST: low
// REQUIRES: ServiceInstalled / driver-load telemetry (uneven across sensor versions)
// FALSE POSITIVES: vendor driver installs -- baseline service names + signer; alert first-seen
#event_simpleName=/CreateService|ModifyServiceBinary|DriverLoad/
| ServiceImagePath=/\.sys$/i
| ServiceImagePath!=/\\Windows\\System32\\(drivers|DriverStore)\\/i
| table([@timestamp, ComputerName, ServiceDisplayName, ServiceImagePath, ImageFileName, SHA256HashData], limit=200)

Looks for: a scheduled-task registration or a task-launched signed binary executing from a non-standard path (side-load staging directory) — the WIN_DRV trigger. FP: legit apps use scheduled tasks + side directories — flag user/temp/ProgramData paths and correlate to Q1 driver writes on the same host.

// HUNT: scheduled-task-triggered DLL side-load staging (WIN_DRV)
// MITRE: T1053.005, T1574.002 | CONF: medium  FP: med  COST: low
// REQUIRES: ScheduledTaskRegistered + ProcessRollup2
// FALSE POSITIVES: legit task-launched apps -- restrict to user/temp paths; correlate Q1
#event_simpleName=/ScheduledTaskRegistered|ProcessRollup2|SyntheticProcessRollup2/
| (ScheduledTaskName=/.+/ or ParentBaseFileName=/^(svchost|taskeng|taskhostw)\.exe$/i)
| ImageFileName=/\\(Temp|AppData|ProgramData|Users\\Public)\\/i
| ImageFileName=/\.exe$/i
| table([@timestamp, ComputerName, UserName, ScheduledTaskName, ParentBaseFileName, ImageFileName, CommandLine], limit=200)

Looks for: spoolsv.exe spawning unexpected children or writing a print-processor DLL, and anomalous svchost.exe children consistent with injection — the WIN_PLUS load path. FP: printer drivers legitimately extend the Spooler — exclude signed printer-vendor processes and known print-processor paths.

// HUNT: Print Spooler print-processor loader / svchost injection (WIN_PLUS)
// MITRE: T1547.012, T1055 | CONF: medium  FP: med  COST: low
// REQUIRES: ProcessRollup2 (+ module load if available)
// FALSE POSITIVES: legit printer drivers extend Spooler -- exclude signed vendor procs
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^spoolsv\.exe$/i
| FileName!=/^(spoolsv|splwow64|rundll32)\.exe$/i
| ImageFileName!=/\\Windows\\System32\\spool\\/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine], limit=200)

Looks for: a non-system / user-path binary opening a TCP listener — a pre-rootkit window onto the backdoor's hidden port before the driver diverts/hides it. FP: high — many apps listen; restrict to user/temp-path images and unexpected ports, and correlate to Q1-Q4 on the same host. Note: WIN_DRV's port-knock diversion means the listener may never appear in host telemetry post-install — treat absence as inconclusive, not clean.

// HUNT: anomalous TCP listener from user-path binary (hidden-port covert channel)
// MITRE: T1205.001, T1014 | CONF: medium  FP: high  COST: med
// REQUIRES: NetworkListenIP4
// FALSE POSITIVES: many apps listen -- restrict to user/temp images; correlate Q1-Q4
#event_simpleName=NetworkListenIP4
| ImageFileName=/\\(Temp|AppData|ProgramData|Users\\Public)\\/i
| ImageFileName!=/\\Windows\\System32\\/i
| table([@timestamp, ComputerName, ImageFileName, LocalAddressIP4, LocalPort, Protocol_decimal], limit=200)

Looks for: outbound connections from an injected svchost.exe or a user-path binary to non-RFC1918 addresses (WebSocket / TCP C2 to the hardcoded server). FP: high — svchost talks to many endpoints; baseline normal svchost egress and correlate to Q4 injection / Q1-Q2 install. Replace the C2 placeholder once atomic infra is published.

// HUNT: WebSocket / hardcoded-C2 beacon from injected svchost or user-path binary
// MITRE: T1071, T1090 | CONF: medium  FP: high  COST: med
// REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: svchost has broad egress -- baseline + correlate Q4 injection
#event_simpleName=NetworkConnectIP4
| (ImageFileName=/\\svchost\.exe$/i or ImageFileName=/\\(Temp|AppData|ProgramData|Users\\Public)\\/i)
| RemoteAddressIP4!=/^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.|127\.|169\.254\.)/
| table([@timestamp, ComputerName, ImageFileName, RemoteAddressIP4, RemotePort, Protocol_decimal], limit=200)

Looks for: UDP egress (Protocol_decimal=17) to a fixed external endpoint on a non-standard port from a non-browser, non-DNS process — the SprySOCKS UDP C2 channel. FP: high — VoIP/QUIC/game traffic — exclude 53/123/443 and known media apps; aggregate to spot a stable beacon to one host.

// HUNT: UDP C2 beacon to fixed external endpoint (non-DNS)
// MITRE: T1095 | CONF: medium  FP: high  COST: med
// REQUIRES: NetworkConnectIP4 with Protocol_decimal
// FALSE POSITIVES: VoIP/QUIC/games -- exclude 53/123/443 + media apps; look for stable beacon
#event_simpleName=NetworkConnectIP4
| Protocol_decimal=17
| RemoteAddressIP4!=/^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.|127\.|169\.254\.|224\.|239\.)/
| RemotePort!=53 | RemotePort!=123 | RemotePort!=443
| groupBy([ComputerName, ImageFileName, RemoteAddressIP4, RemotePort], function=count(as=beacons))
| beacons >= 5
| table([ComputerName, ImageFileName, RemoteAddressIP4, RemotePort, beacons], limit=200)

Looks for: an injected svchost.exe or user-path binary spawning a burst of recon/management LOLBins (the 30+ command set: sysinfo, process/service enum, file ops) — hands-on-keyboard operation. FP: medium — admin/monitoring tooling does this — require an unusual parent (injected svchost / user-path) and a tight time burst; correlate to Q4.

// HUNT: SprySOCKS recon/command burst under injected svchost or user-path parent
// MITRE: T1059, T1057, T1007 | CONF: medium  FP: med  COST: med
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: admin/monitoring tooling -- require injected/user-path parent + burst
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(svchost|spoolsv)\.exe$/i
| FileName=/^(whoami|net|net1|ipconfig|systeminfo|tasklist|sc|reg|netstat|query)\.exe$/i
| groupBy([ComputerName, ParentBaseFileName], function=count(as=cmds))
| cmds >= 4
| table([ComputerName, ParentBaseFileName, cmds], limit=200)