Security teams detect CORALDECK by hunting for unusual activity on Windows endpoints, especially persistence, process injection, and covert communications that do not align with approved software. Review startup mechanisms, parent-child process anomalies, and outbound connections to rare destinations. Use endpoint telemetry together with network logs to trace delivery, execution, and operator control.
How to spot CORALDECK on Windows endpoints
Detection starts with endpoint behaviour, not filenames. CORALDECK should stand out through persistence, process injection, and activity that does not fit approved software patterns. Look for unusual startup entries, suspicious parent-child process chains, and processes that create network connections after execution. The goal is to find the execution path, then confirm whether it matches known business tools or covert operator activity.
A useful baseline is normal Windows behaviour in your environment, because this threat is easier to spot as an anomaly than as a signature. Correlate EDR alerts with common host telemetry such as service creation, scheduled tasks, registry run keys, unsigned or unexpected binaries, and memory-related behaviour that suggests code is being run inside another process rather than by itself.
For deeper hunting, treat rare outbound destinations and inconsistent process lineage as a linked pattern. If a short-lived or otherwise benign-looking process spawns network traffic, writes persistence artifacts, or immediately chains into another process, that sequence is worth investigating. NHIMG’s Malware Guide is useful for mapping those behaviours to broader malware tradecraft and detection logic.
What telemetry gives the clearest signal
Endpoint telemetry usually gives the strongest signal because CORALDECK detection depends on behaviour across execution, persistence, and lateral operator control. Parent-child process anomalies can show how the malware launched, while memory and injection artefacts can show how it hid execution. On their own, these clues may be noisy; together they can form a reliable sequence that points to compromise rather than admin tooling.
Network logs matter because covert communications often reveal what the host tried to hide. Focus on rare external IPs, unusual domains, odd timing patterns, and connections from processes that should not normally talk to the internet. When endpoint and network data are correlated, you can separate isolated suspicious events from a connected intrusion chain.
If you have Sysmon, EDR, or similar telemetry, prioritise events that show process creation, remote thread injection, image loads, command-line oddities, and persistence modifications. Those signals are especially valuable when the same host also shows outbound traffic to destinations that are new to the environment or inconsistent with the workstation’s role.
How to investigate and confirm suspicion
Start by reconstructing the timeline: initial execution, persistence creation, any process injection behaviour, and the first outbound connection. Then compare each step against approved software, patching tools, endpoint management agents, and expected line-of-business applications. The question is not just whether an event is unusual, but whether the sequence makes operational sense for that host.
Verify whether the suspected process inherited from a trusted parent, launched from user-writable paths, or used living-off-the-land binaries to blend in. Those details often matter more than the apparent process name. If the chain includes unexpected child processes, encoded commands, or memory-backed execution, treat the finding as higher confidence even before you identify the final payload.
Network-side validation should check whether the destination is rare across the estate, whether the traffic pattern is periodic or beacon-like, and whether other hosts show the same destination. A single unusual host can still be enough to justify containment if the endpoint evidence and network evidence align.
Risk and Threat Considerations
CORALDECK is most dangerous when it blends into ordinary Windows activity, because that delays triage and gives an operator time to persist. Persistence plus injection means the attacker may survive reboots and hide inside trusted processes, which can make one compromised host a foothold for broader access.
Failure mechanism: The malware can evade shallow checks by using legitimate-looking process trees, startup locations, and covert outbound traffic, so defenders who watch only for obvious malware names or static signatures may miss the compromise.
Impact: Delayed detection increases the chance of credential theft, additional payload delivery, and operator control over more than one endpoint, especially if the same persistence path exists across many hosts.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1053 — Scheduled Task/Job | Persistence hunting often centers on scheduled task creation on Windows hosts. |
| T1055 — Process Injection | The question explicitly calls for detecting process injection on endpoints. | |
| T1071 — Application Layer Protocol | Covert communications often use common protocols to hide operator control traffic. | |
| Recommendation — Map persistence events to scheduled-task abuse and alert on new or modified tasks from unusual parents. Hunt for remote-thread creation, hollowing, and cross-process memory writes from suspicious binaries. Inspect beacon-like outbound traffic over common protocols for rare destinations and periodicity. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and network services are monitored | Detection here depends on correlating endpoint activity with outbound network monitoring. |
| Recommendation — Correlate endpoint telemetry with network monitoring to detect unusual connections and beaconing. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Endpoint and network logs are the core evidence base for this detection workflow. |
| Recommendation — Centralize and review endpoint and network logs for process, persistence, and connection anomalies. | ||
Practitioner Guidance
What to prioritise: Confirm the host sequence first, then decide whether the activity is isolated or part of a wider campaign. A single injected process with a rare external connection is enough to justify containment when it appears on a sensitive system.
What to verify: Check whether the startup artifact, parent-child chain, and destination domain all make sense together. If one element looks suspicious but the others do not, keep hunting until you can explain the full chain or rule it out with evidence.
Decision rule: If the endpoint shows persistence plus process injection, treat the case as probable compromise even if the initial alert is low confidence. If only one of those signals is present, widen collection before escalating, because one weak indicator alone is often ambiguous.
Practitioner takeaway: The most reliable CORALDECK hunts combine host behaviour and network evidence, because the malware is easier to prove through the sequence it creates than through any single indicator.