Background

On 13 October 2026 SecurityWeek and, a day later, Security Affairs covered new Netskope Threat Labs research on XWorm. Netskope reports four XWorm versions (6.4, 6.5 “XWorm Reborn”, 7.2 and 7.4) active at once, following a cracked builder in June 2025 and a leaked modified 6.4 source in August 2025. Per Security Affairs’ summary, Netskope counted 1,236 detection events across more than 100 customer organisations in Q3 2026, about four times Q3 2025, and known plugins grew from 35 to 46.

This is vendor telemetry from Netskope’s customer base, not a global prevalence figure. The sources we opened do not describe persistence, ports or the initial delivery vector, so this guide covers only the behaviours Netskope documents. IOCs are published in Netskope’s GitHub repository; we did not open that page, so pull them from there.

Behaviours worth detecting

Per Netskope:

  • Maps plugin: sets HKCU\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location\Value to Allow (REG_SZ) to skip the location prompt, tries a GPS fix via GeoCoordinateWatcher.TryStart with a 15-second timeout, and falls back to hxxp://ip-api[.]com/csv/?fields=lat,lon.
  • Microphone plugin: uses NAudio WaveInEvent, 8 kHz 16-bit mono, 500 ms buffers, gzip then base64, sent over XWorm’s AES channel.
  • HBrowser: the operator drives the victim’s live browser session through replayed mouse/keyboard/paste commands and a screenshot stream. Netskope says credentials are not harvested and that this bypasses MFA, because the already-authenticated session is used.
  • V7.4: XBinder dropper and NTdll.dll unhooking, with the library loaded from %AppData% (mapped to T1562.001).

Microphone and HBrowser activity happens in-process and over the C2 channel, so there is little endpoint telemetry to key on beyond the host process and its network behaviour. We do not offer a rule for them.

The code below is untested. Our assessment: legitimate apps (and users clicking “Allow”) also write this key, so treat it as a lead, not a verdict.

title: Location Capability Consent Set To Allow By Non-Standard Process
id: 6f1d0a52-3c7e-4b8a-9d14-0e5b7a2c9f31
status: experimental
description: Detects a process writing the HKCU location ConsentStore value to Allow, behaviour Netskope attributes to the XWorm Maps plugin. Untested.
references:
  - https://threatlabs.netskope.com/blog/2026/09/xworm-reborn
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: '\CapabilityAccessManager\ConsentStore\location\Value'
    Details: 'Allow'
  filter_system:
    Image|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Windows\ImmersiveControlPanel\'
  condition: selection and not filter_system
falsepositives:
  - Legitimate location-aware apps; users approving the prompt via Settings
  - Enterprise management agents
level: medium
tags:
  - attack.defense_evasion
  - attack.t1562.001

Sigma: ntdll.dll loaded from AppData

Requires Sysmon Event ID 7 (image load), which is high volume; scope it before enabling broadly. Also untested.

title: ntdll.dll Loaded From User-Writable AppData Path
id: b3a94e17-58d2-4c06-8f7e-12c4d9a06b85
status: experimental
description: Detects a copy of ntdll.dll loaded from AppData, consistent with Netskope's description of NTdll unhooking in XWorm 7.4. Untested.
references:
  - https://threatlabs.netskope.com/blog/2026/09/xworm-reborn
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: '\ntdll.dll'
    ImageLoaded|contains: '\AppData\'
  condition: selection
falsepositives:
  - Software shipping its own ntdll copy (rare); some security or debugging tools
level: high
tags:
  - attack.defense_evasion
  - attack.t1562.001

KQL (Defender XDR)

Untested; field availability varies by tenant. Adjust the lookback and exclusions.

// 1. Location consent flipped to Allow
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where ActionType == "RegistryValueSet"
| where RegistryKey endswith @"CapabilityAccessManager\ConsentStore\location"
| where RegistryValueName =~ "Value" and RegistryValueData =~ "Allow"
| where InitiatingProcessFolderPath !startswith @"c:\windows\system32\"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine

// 2. ntdll.dll loaded from AppData
DeviceImageLoadEvents
| where Timestamp > ago(7d)
| where FileName =~ "ntdll.dll" and FolderPath contains @"\AppData\"
| project Timestamp, DeviceName, InitiatingProcessFileName, FolderPath, InitiatingProcessSHA256

// 3. ip-api.com lookups by non-browser processes (fallback geolocation)
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has "ip-api.com"
| where InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe")
| summarize Hits=count() by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath

Query 3 will be noisy in environments with scripts or tools that use ip-api.com; baseline for a week first. Our assessment is that the strongest signal is correlation: an unsigned process in a user-writable path that triggers query 1 or 3 and then holds a long-lived outbound connection.

Response notes

  • Because HBrowser rides an authenticated session, resetting passwords alone will not evict an operator. Revoke active sessions and tokens for the user as well. This follows from Netskope’s description; it is our inference, not a vendor recommendation.
  • Check Windows Privacy settings logs and microphone/location usage on affected hosts to scope exposure.
  • Hunt the published IOCs from Netskope’s repository against proxy and DNS logs.

Unverified

The four version labels appear in Security Affairs’ summary of the Netskope report, and the per-version details came from the Netskope page. We did not validate any rule in a lab.