WindowsAudit Backdoor: Inside a .NET RAT That Hides in Discord

Advisory: Profero has observed this campaign active across multiple environments, and based on observed patterns and tradecraft, it may be positioning for escalation toward a broader ransomware operation. Profero has notified the Israeli National Cyber Directorate (INCD) of this activity. Organizations that identify any of the indicators of compromise (IOCs) listed below in their environments are encouraged to take prompt investigative action. If you would like to confirm whether your organization appears among the environments where this activity has been observed, or to discuss the IOCs further, please contact our team at contact@profero.io.

Executive Summary

In April 2026, Profero IRT identified a .NET 8 backdoor named WindowsAudit.exe on a victim host. The binary is a modular C# RAT (version v1.5.77) that uses Discord as its primary C2 channel, MQTT as a secondary, and Telegram as an optional fallback. It runs as a Windows Service under LocalSystem, drops a companion persistence binary (WinSATSvc / WinSATTemp.exe), and covers credential theft, Active Directory abuse, Safe Mode EDR removal, WireGuard tunneling, screen and webcam capture, and keylogging.

Binary: unsigned, 101 MB, .NET single-file bundle, compiled 19 March 2026.

What Happened

Profero IRT recovered WindowsAudit.exe from a victim host and reverse engineered it. The binary is a .NET native apphost — a statically-linked native loader that stages and runs an embedded managed DLL with its dependencies. Extracting and decompiling WindowsAudit.dll to C# yielded a ~28,000-line remote administration framework with clean separation between command dispatch, C2 transports, and feature modules.

On startup the agent:

1. Patches Windows Defender with an Add-MpPreference exclusion for its install path and process name
2. Registers itself as a Windows Service (WindowsAudit)
3. Drops a self-backup at %CommonProgramData%\Microsoft\Windows\WinSAT\WinSATTemp.exe
4. Adds a WMI event subscription
5. Writes registry Run keys
6. Registers a RemoteAdminEdrCleanup scheduled task that re-arms the operator after a Safe Mode reboot

The single-instance guard is the mutex Global\WindowsAuditSingleInstance.

Command-and-Control Architecture

WindowsAudit ships three independent C2 transports. The agent fails open to the next channel if one is unavailable, and all three blend with legitimate enterprise traffic.

Discord (Primary)

• Authenticates with a hardcoded bot token using gateway intents 33281 (GuildMessages, GuildMessageReactions, MessageContent, GuildMembers, GuildPresences)
• Polls two channels in a single guild: a bus channel for tasking and a store channel for results and large file transfers (up to 25 MB per attachment)
• Registers Discord slash commands on connect; operators task agents by exact hostname, partial hostname, Machine GUID, GUID prefix, or "all" for broadcast
• Reconnects with randomized 15–30 second back-off

MQTT (Secondary)

• Connects to a public HiveMQ Cloud broker on port 8883 over TLS
• Tasks published to remoteadmin/commands, results to remoteadmin/results
• Client ID format ra-agent-{MachineName}-{short-guid} leaks hostname to the broker audit log
• Supports retained messages for offline agents

Telegram (Optional)

If configured, the agent accepts a reduced command set over Telegram: ping, exec, ps, screenshot, record, browse, sysinfo, netscan, kerbrenew, service, process, inventory, wol, registry.

Persistence Mechanisms

Companion Dropper: WinSATSvc

A second .NET 8 binary — WinSATSvc.exe — masquerades as the legitimate Windows System Assessment Tool service. On a 3-minute loop it checks whether the primary agent process is running. If not, it polls the same Discord channels for a restore_manifest message, pulls GZip-compressed restore_chunk attachments, and reassembles them into WinSATTemp.exe — a fresh copy of the primary WindowsAudit.exe agent, not the watchdog itself — then launches it. Requests are keyed by a 12-character hex requestId. The dropper uses 120-second HTTP timeouts over Discord API v10.

Credential Access

Active Directory Abuse

The agent ships a near-complete AD attack toolkit:

From SYSTEM, domain takeover is one command.

Execution, Evasion, and EDR Tear-Down

Userland Hook Bypass (Hell’s Gate)

The agent detects user-mode hooks on NT APIs and recovers original syscall numbers (SSNs) so syscalls bypass EDR userland instrumentation entirely.

EDR Removal

Targets CrowdStrike, SentinelOne, Carbon Black, Cylance, Symantec, McAfee, Trellix, Sophos, ESET, Kaspersky, Trend Micro, Cortex XDR, Cybereason, Bitdefender, Webroot, and Malwarebytes — detected by registry uninstall key, service name, and install directory.

Removal sequence:

1. Silent uninstall via registry-parsed uninstall strings
2. sc.exe force-stop + takeown.exe / icacls.exe / rd /s /q on install directories
3. If both fail: reboot into Safe Mode (bcdedit /set {current} safeboot minimal), run RemoteAdminEdrCleanup scheduled task, remove EDR SafeBoot registry entries, restore normal boot, reboot again

In-Process Patches

Execution Primitives

The agent supports four execution methods:

• exec — CMD shell
• ps — PowerShell
• shell_start / shell_input / shell_stop — interactive shell sessions over Discord threads
• smb_exec — remote execution via WMI/SMB on remote hosts

Process Manipulation

• APC injection / process hollowing (process_hollow)
• Parent PID spoofing (ppid_spoof)
• PE header zeroing (pe_stomp) in self, by name, or by PID

Surveillance Capabilities

VPN, Tunneling, and Lateral Movement

Indicators of Compromise

Hashes, the Discord bot token, channel/guild IDs, and the MQTT broker hostname and credentials are redacted here. The full IOC set is available from contact@profero.io.

Note on IPs: IP addresses below resolved to Discord and Cloudflare CDN endpoints at analysis time. They rotate and are not safe to block outright. Use them for retrospective hunting; base prevention on domain and TLS-SNI indicators.

File System

Services

Registry

Scheduled Tasks

Mutex

Global\WindowsAuditSingleInstance

Network (DNS / TLS SNI)

Other Artifacts

Detection Guidance

1. Service creation — Alert on any service with display name "Windows Audit", description "Windows security audit and compliance monitoring service", or where binPath points outside %SystemRoot% or Program Files.

2. Defender exclusion — EDR rule for Add-MpPreference -ExclusionPath ... -ExclusionProcess WindowsAudit.exe; flag any Add-MpPreference issued from a non-administrative process tree.

3. Safe Mode pivot — Alert on bcdedit /set {current} safeboot minimal, creation of the RemoteAdminEdrCleanup scheduled task, or deletion of SafeBoot registry entries for EDR services.

4. Discord/MQTT egress — Block or alert on TLS connections from server VLANs to discord[.]com, gateway[.]discord[.]gg, and *[.]hivemq[.]cloud. Specific guild and channel IDs for alerting available on request.

5. Persistence triplet — Hunt for simultaneous presence of the WindowsAudit service + WinSATTemp.exe in the WinSAT directory + both HKCU Run keys. No legitimate software leaves this combination.

6. Mutex — Any endpoint tool that enumerates kernel objects will find Global\WindowsAuditSingleInstance on infected hosts.

MITRE ATT&CK Mapping (Selected)

For the full IOC set including hashes, Discord identifiers, and MQTT broker details, contact contact@profero.io.