Ten Minutes to Containment: How Agentic MXDR Scoped a Fake Claude Desktop Intrusion

Contributors: Kithu Shajil, Sudeesh M, Vishak U Kavitha, Govardhan R S, Anurag Kuttan, Blessy Sumam, Amit Arad, Bijoy Anil

Executive Summary

A single alert flagging a masqueraded scheduled task could easily have been resolved as an isolated finding. Instead, our threat hunters used it as the catalyst for an aggressive, reactive hunt. The real story lies in how that hunt was conducted: hunters deployed the CyberProof threat hunting agent—a core component of our Agentic MXDR service—which executed an automated, correlated, campaign-wide sweep across the endpoint estate in approximately ten minutes.

The agent analyzed every phase of the kill chain in a single pass: lure execution, DLL sideloading, Microsoft Defender tampering, scheduled-task persistence, and command-and-control (C2) retrieval. It delivered per-stage verdicts accompanied by clear confidence scoring—validating the malicious chain where evidence was definitive, while properly classifying sparse telemetry as inconclusive rather than generating false assumptions.

The observed activity directly matched an active, in-the-wild malvertising campaign tracked by Huntress as FakeAgent, which exploits Claude’s public artifact hosting and spoofed desktop installers to distribute SectopRAT. The telemetry revealed classic indicators: a trojanized ClaudeDesktop.exe, a secondary DockerDesktop.exe loader, libcef.dll sideloading via a Java Chromium Embedded Framework (JCEF) helper, disguised persistence mechanisms, and blockchain-based C2 infrastructure.

Armed with the agent’s correlated intelligence, Tier 2 analysts and threat hunters swiftly validated the findings, remediated the persistence mechanisms, and reimaged the affected endpoint. This case study examines how the hunting agent scoped the intrusion within ten minutes and how human analysts took it across the finish line.

The Initial Alert

The investigation began when detection rules flagged a masqueraded scheduled task. A user-executed binary named ClaudeDesktop.exe invoked schtasks.exe to register a persistent task scheduled to run at user logon with elevated privileges:

schtasks.exe /create /tn "MicrosoftEdgeUpdate" 

/tr "C:\Users\[REDACTED]\AppData\Roaming\EdgeUpdate-1b4adb1f\DockerDesktop.exe" 

/sc onlogon /rl highest /f 

The command mimics a legitimate Microsoft Edge browser update task while pointing directly to an executable housed in a randomized AppData\Roaming subfolder. Furthermore, the payload itself is masqueraded under another trusted application name (DockerDesktop.exe). Creating a highest-privilege logon task executing out of a user-writable path is a textbook persistence technique designed to blend in during surface-level administrative reviews.

Figure 1: The incident record and verdict, capturing the multi-stage persistence and collection activity and the assessed SectopRAT attribution.

What the Agent Executed in Ten Minutes

Rather than handling the scheduled task alert in isolation, hunters initiated the threat hunting agent to execute a reactive hunt centered on the fake-installer hypothesis. Over approximately ten minutes, it ran a correlated series of Microsoft Sentinel (KQL) queries across the endpoint telemetry, testing each phase of the suspected intrusion chain concurrently:

• Lure Execution: Detection of fake Claude or Docker installers launched from user-writable paths originating from suspicious domains.
• DLL Sideloading: Identification of libcef.dll or tempdir.dll sideloading from non-standard directories within Claude or Docker process trees.
• Defense Evasion: Execution of Microsoft Defender tampering scripts or directory exclusions spawned by the installer lineage.
• Persistence: Scheduled-task creation referencing Claude or Docker payloads in user-writable paths.
• C2 Communication: Identification of campaign IOCs and C2 network callbacks originating from the installer or sideload process lineage.
• Multi-Stage Correlation: Correlation of lure execution, DLL sideloading, local defense evasion, and persistence mechanisms across the host estate.

Figure 2: The threat hunting agent’s campaign summary, highlighting ten queries executed in roughly ten minutes alongside correlated critical findings across the kill chain.

Figure 3: The correlated query set executed by the agent, targeting distinct stages from lure execution and DLL sideloading to persistence and C2.

The agent compiled a correlated campaign summary with distinct confidence scoring per stage. This granular scoring allows security operations teams to act on high-confidence indicators immediately without getting bogged down by speculative assumptions:

Confirmed at High Confidence:

• Defender Tampering: The lure spawned PowerShell cmdlets to register directory exclusions for the user profile, actively blinding Microsoft Defender to the staging directory.
• Scheduled-Task Persistence: ClaudeDesktop.exe spawned schtasks.exe to register the MicrosoftEdgeUpdate task, executing DockerDesktop.exe from AppData\Roaming at user logon with elevated privileges.
• Multi-Stage Correlation: Execution, DLL sideloading, defense evasion, and persistent task creation were correlated within a tight execution window on a single endpoint.

Figure 4: A high-confidence finding detailing how the agent reconstructed the persistence chain via ClaudeDesktop.exe and schtasks.exe.

Assessed but Pending External Verification:

• Payload Provenance and Family: Telemetry lacked initial lure web-traffic provenance, and the payload hash yielded no initial matches in public threat intelligence databases at the time of the hunt. Additionally, direct queries for traditional C2 traffic returned no hits. Telemetry alone allowed for family assessment rather than definitive internal confirmation

Why Speed Matters

The primary value of agent-led threat hunting is not analyst replacement; it is the radical compression of time. The slowest phase of any investigation—the breadth-first exploration across disparate telemetry tables and speculative hypotheses—is reduced from hours to minutes.

When evaluating an isolated alert, an analyst must manually prioritize pivots, construct complex queries, execute them sequentially, and stitch together the results. In contrast, the threat hunting agent runs these investigative paths concurrently, correlates the findings, and presents a fully scoped attack graph. This shifts the human role to high-leverage decision-making: evaluating confidence scores, confirming edge cases, and directing remediation strategy.

Attack Chain Reconstruction & Campaign Attribution

The absence of traditional C2 network indicators and the specific mechanics of the loader align directly with the architecture of the FakeAgent campaign.

As documented by Huntress, the attack chain begins when a victim searches Bing for the Claude desktop application. Sponsored malvertising links direct users to legitimate-looking public Claude Artifact pages hosted on claude.ai, which subsequently initiate the download of a trojanized ClaudeDesktop.exe. The use of legitimate Anthropic hosting infrastructure increases user trust and bypasses common web reputation filters.

Figure 5: The agent’s attack chain reconstruction, tracing manual installer execution through updater-styled scheduled-task persistence.

The intrusion utilizes two functionally paired loaders:

1. Immediate Execution Loader (ClaudeDesktop.exe): Staged in the user’s Downloads folder, this loader executes the initial payload and alters endpoint configurations.
2. Persistent Loader (DockerDesktop.exe): Stored under AppData\Roaming, this executable is registered as a scheduled task to ensure persistent reinfection across system reboots.

The lure binary reuses a legitimate, signed JetBrains jcef_helper.exe component to execute a malicious, VMProtect-packed libcef.dll via DLL sideloading. This technique allows malicious code to run under the context of a trusted process, directly explaining why the file named ClaudeDesktop.exe reported Java Chromium Embedded Framework (JCEF) Helper internal metadata.

The lack of standard C2 callbacks is explained by the malware’s use of EtherHiding. Rather than querying static domains or dynamic DNS infrastructure, the malware references an Ethereum smart contract and extracts encrypted C2 parameters directly from public blockchain transaction data. This provides threat actors with highly resilient, takedown-resistant endpoint rotation. Outbound network requests to public blockchain RPC nodes reflect this configuration retrieval phase rather than standard attacker-hosted command loops.

Combining our verified execution telemetry with published threat intelligence from Huntress firmly attributes this intrusion to the FakeAgent SectopRAT campaign.

Response & Remediation

While the Agentic MXDR threat hunting agent mapped the scope and reconstructed the attack chain in ten minutes, human analysts directed the response.

Because SectopRAT provides infostealing capabilities and hidden remote desktop access, simply deleting the scheduled task and the malicious DLL was insufficient. Threat hunters and Tier 2 analysts executed full incident containment:

• Isolated the affected endpoint from the corporate network.
• Revoked user session tokens and initiated an enterprise credential reset.
• Removed unauthorized Microsoft Defender path exclusions and scheduled tasks.
• Re-imaged the impacted device to guarantee complete remediation.
• Conducted a retrospective identity and access audit to verify no credential abuse occurred across adjacent systems.

Detection Logic & Hunting Guidance

Security teams can detect similar fake installer and malvertising patterns using the following behavioral signatures:

• Scheduled tasks created via schtasks.exe /create using /sc onlogon and /rl highest pointing to executables in AppData\Roaming, AppData\Local, or Downloads.
• Tasks masquerading under common updater naming conventions (MicrosoftEdgeUpdate, GoogleUpdate) pointing to user-writable paths.
• Binary metadata mismatches, such as executables labeled ClaudeDesktop.exe with internal descriptions matching jcef_helper.exe or other third-party utilities.
• PowerShell execution of Add-MpPreference -ExclusionPath targeting user-profile directories within close temporal proximity to newly downloaded software.
• Loading of libcef.dll from user-writable paths outside standard Program Files installations.
• Outbound traffic to public blockchain RPC nodes originating from newly executed installer lineages.

Threat Hunting Query

let suspiciousOrigins = dynamic(["claude.ai/public/artifacts", "download-app.us", "downloading-api.it.com", "claude-desktop.gitlab.io", "claude.ai.download-app.us", "it.com/html/claude/win", "claude-code-cmd.squarespace.com", "code.claude.ai/download", "install-files.com", "claude-code", "claude-desktop"]);
let suspiciousCreates =
DeviceFileEvents
| where TimeGenerated between (datetime(2026-08-01T10:15:00Z) .. datetime(2026-08-13T10:15:00Z))
| where ActionType in ("FileCreated", "FileDownloaded", "FileModified", "FileRenamed")
| where FileName in~ ("ClaudeDesktop.exe", "DockerDesktop.exe", "Claude.exe", "ClaudeSetup.exe", "Claude Desktop.exe", "Docker Desktop.exe")
| where FolderPath has_any (@"\Users\", @"\Downloads\", @"\Temp\", @"\AppData\", @"\Desktop\", @"\ProgramData\", @"\Public\")
| where (
tostring(FileOriginUrl) has_any (suspiciousOrigins)
or tostring(FileOriginReferrerUrl) has_any (suspiciousOrigins)
or tostring(FileOriginUrl) startswith "http"
or tostring(FileOriginReferrerUrl) startswith "http"
or InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe", "brave.exe", "opera.exe", "outlook.exe", "winword.exe", "excel.exe", "powerpnt.exe", "7zFM.exe", "7zG.exe", "WinRAR.exe", "explorer.exe")
)
| project DeviceId, DeviceName, CreatedTime = TimeGenerated, FileName, FolderPath, FileOriginUrl, FileOriginReferrerUrl, SHA256;
let suspiciousExec =
DeviceProcessEvents
| where TimeGenerated between (datetime(2026-08-01T10:15:00Z) .. datetime(2026-08-13T10:15:00Z))
| where FileName in~ ("ClaudeDesktop.exe", "DockerDesktop.exe", "Claude.exe", "ClaudeSetup.exe", "Claude Desktop.exe", "Docker Desktop.exe")
| where FolderPath !startswith @"C:\Program Files\Anthropic\"
| where FolderPath !startswith @"C:\Program Files\Docker\"
| where FolderPath !startswith @"C:\Program Files (x86)\Anthropic\"
| where FolderPath !startswith @"C:\Program Files (x86)\Docker\"
| where FolderPath has_any (@"\Users\", @"\Downloads\", @"\Temp\", @"\AppData\", @"\Desktop\", @"\ProgramData\", @"\Public\")
| where (
InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe", "brave.exe", "opera.exe", "outlook.exe", "winword.exe", "excel.exe", "powerpnt.exe", "7zFM.exe", "7zG.exe", "WinRAR.exe", "wscript.exe", "cscript.exe", "powershell.exe", "cmd.exe", "mshta.exe", "explorer.exe")
or InitiatingProcessParentFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe", "brave.exe", "opera.exe", "outlook.exe", "winword.exe", "excel.exe", "powerpnt.exe", "7zFM.exe", "7zG.exe", "WinRAR.exe", "wscript.exe", "cscript.exe", "powershell.exe", "cmd.exe", "mshta.exe", "explorer.exe")
or ProcessCommandLine has_any ("--silent", "--update", "--install", "/S", "/quiet", "schtasks", "taskschd", "libcef.dll")
or isempty(ProcessVersionInfoCompanyName)
or ProcessVersionInfoCompanyName !in~ ("Anthropic PBC", "Anthropic", "Docker Inc.", "Docker")
or isempty(ProcessVersionInfoOriginalFileName)
or ProcessVersionInfoOriginalFileName !in~ ("ClaudeDesktop.exe", "DockerDesktop.exe", "Docker Desktop.exe", "Claude.exe", "ClaudeSetup.exe", "Claude Desktop.exe")
)
| project DeviceId, DeviceName, ExecTime = TimeGenerated, FileName, FolderPath, ProcessCommandLine, ProcessVersionInfoCompanyName, ProcessVersionInfoOriginalFileName, InitiatingProcessFileName, SHA256;
suspiciousCreates
| join kind=inner hint.strategy=broadcast (suspiciousExec) on DeviceId, FileName
| where ExecTime between (CreatedTime .. CreatedTime + 2h)
| where (
tostring(FileOriginUrl) has_any (suspiciousOrigins)
or tostring(FileOriginReferrerUrl) has_any (suspiciousOrigins)
or tostring(FileOriginUrl) startswith "http"
or tostring(FileOriginReferrerUrl) startswith "http"
or InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe", "brave.exe", "opera.exe", "outlook.exe", "winword.exe", "excel.exe", "powerpnt.exe", "7zFM.exe", "7zG.exe", "WinRAR.exe", "wscript.exe", "cscript.exe", "powershell.exe", "cmd.exe", "mshta.exe", "explorer.exe")
)
| project TimeGenerated = ExecTime, DeviceName, DeviceId, FileName, FolderPath, ProcessCommandLine, ProcessVersionInfoCompanyName, ProcessVersionInfoOriginalFileName, InitiatingProcessFileName, FileOriginUrl, FileOriginReferrerUrl, SHA256
| top 100 by TimeGenerated desc

Figure 6: The lure-execution query results illustrating ClaudeDesktop.exe executing out of user-writable paths alongside jcef_helper.exe metadata mismatches.

Indicators of Compromise (IOCs)

MITRE ATT&CK Mapping

Strategic Recommendations

• Assume Full Compromise: Treat endpoints that execute trojanized binaries as fully compromised. Quarantine, re-image, and perform full credential resets for all associated accounts.
• Audit Antivirus Exclusions: Regularly inspect Defender exclusion paths via Group Policy or EDR telemetry to detect unauthorized exclusions added to user profiles.
• Harden Task Scheduler Monitoring: Alert on newly created scheduled tasks running with elevated privileges out of AppData or Downloads directories.
• Enforce Software Governance: Restrict standard user rights to install local binaries and enforce enterprise software distribution channels.
• Reinforce Malvertising Awareness: Educate technical and developer staff on the risks of search engine ad injection and fake AI developer tools hosted across public web assets.

Conclusion

What began as an isolated alert for a masqueraded scheduled task ultimately uncovered a complete FakeAgent intrusion, including defense evasion, DLL sideloading, elevated persistence, and blockchain-based C2 retrieval.

The CyberProof threat hunting agent bridged the gap between a single detection and complete situational awareness, executing an estate-wide, correlated campaign hunt in approximately ten minutes. This allowed Tier 2 analysts and threat hunters to focus on validation, containment, and incident resolution rather than manual query development. Moving rapidly from a single alert to full scope is what transforms routine detections into successful containment.

References 

• Huntress, FakeAgent: Fake Claude Desktop Malvertising Ends in .NET RAT: https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat  
• Cyber Press, Hackers Use Fake Claude Desktop and Bing Ads to Deliver SectopRAT to 29 Organizations: https://cyberpress.org/fake-claude-ads-deliver-sectoprat/