Dohdoor Malware Activity Detection

Daniel Jeremiah@daniyyell

•updated Feb 28, 2026•1•0•39

This rule detects behavior associated with the Dohdoor campaign. It looks for either `curl.exe` executing with command-line arguments containing `.bat` or `.cmd`, or specific LOLBINs (`Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) running from `ProgramData` or `Users\Public` directories with command-line arguments indicative of C2 communication (e.g., `/111111?sub=s`, `/111111?sub=d`, `/X111111`). This combination of activities suggests potential DLL sideloading and subsequent C2 communication, which is unusual in normal business operations.