title: SparrowDoor abnormal svchost.exe parent
description: SparrowDoor spawns an instance of svchost.exe, which would be abnormal.
status: stable
date: 2022/02/28
author: NCSC
version: 1.0
purpose: malware
tlp: white
logsource:
    category: process_creation
     product: windows
detection:
    selection1:
        ParentImage|endswith: '\SearchIndexer.exe'
    selection2:
        Image|endswith: '\svchost.exe'
    condition: selection1 and selection2
level: medium

title: SparrowDoor Clipshot
description: SparrowDoor's loader has an export which is called by the backdoor to log clipboard data.
status: stable
date: 2022/02/28
author: NCSC
version: 1.0
purpose: malware
tlp: white
logsource:
    category: process_creation
     product: windows
detection:
    selection1:
        ParentImage|endswith: '\svchost.exe'
    selection2:
        Image|endswith: '\rundll32.exe'
	selection3:
	    CommandLine|contains: 'curl_easy_init'
    condition: selection1 and selection2 and selection3
level: medium