ESET Research published an analysis of “Cereal”, a modular .NET toolset it attributes with high confidence to the Russia-aligned group Turla. ESET found it on an Exchange server at a governmental organization in Kazakhstan (found 28 November 2025) and at a governmental organization in Romania (compromised 23 December 2025). ESET did not find external command and control (C&C) infrastructure and observed no external network infrastructure; the victim’s own Exchange server acted as the control point. In our judgement that removes most network-indicator hunting, so this playbook focuses on host artifacts. All Sigma, KQL and SPL below is untested.

ESET’s blog post lists no detection rules and points to its white paper and GitHub repository for indicators. Everything below is our derivation from the artifacts described in the blog post, not vendor-supplied, and not validated against live data. We did not read the white paper.

What ESET reported

  • CerealLoader is the only component written to disk as a recognizable .NET file. It runs native code before the .NET runtime executes normal instructions, using Vtable Fixups, and loads an encrypted payload.
  • CerealNeuron is a passive backdoor with no built-in commands. It listens for web requests on paths that look like Exchange traffic, including /owa/sdds/, /AUTODISCOVER/PROXYSERVICE/ and /MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/, and redirects malformed requests to an Exchange-looking error page. CerealHermit is a variant without network code that reads encrypted command files from disk.
  • CerealRunner carries encrypted .NET programs, each one a single task such as EWS mailbox retrieval, Active Directory queries, WMI queries, LSA secrets extraction, volume snapshot listing, and file listing or deletion.
  • CerealBox is injected into EdgeTransport.exe, wraps the handlers of existing transport agents in memory, and stages selected mail (messages with .doc, .docx or .pdf attachments matching hardcoded lists) as compressed, encrypted files on disk. ESET says no new agent appears in Exchange configuration.
  • Loading tricks. ESET describes CerealLoader placed as ncobjapi.dll and as an impersonated wbemcomn.dll in C:\Windows\System32\wbem\, where the WMI service loaded it. It also describes malicious files in the .NET native image cache with names such as Microsoft.Exchange.Search.Mdb.ni.dll; in one sample the code activates only when the parent process is Exchange’s search service.
  • ESET says it could not identify the operators’ ingress IP addresses.

Hunt 1: CerealLoader in the WMI folder

ESET names two file names in System32\wbem. Both names also relate to legitimate Windows components, so treat file creation by an unexpected process, or an unsigned binary, as the signal rather than the name alone (our caveat).

title: Possible Cereal loader DLL written to System32 wbem folder
status: experimental
description: File names and location reported by ESET Research (our derivation)
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '\System32\wbem\ncobjapi.dll'
      - '\System32\wbem\wbemcomn.dll'
  filter_trusted:
    Image|endswith:
      - '\TiWorker.exe'
      - '\TrustedInstaller.exe'
      - '\msiexec.exe'
  condition: selection and not filter_trusted
level: medium

The filter list is our guess at servicing processes. Creation events for these names should be rare, so also check modified time and hash of the existing wbemcomn.dll against your baseline. Baseline file creation in this folder before tuning.

Hunt 2: planted native image cache files

ESET reports malicious CerealLoader files with names like Microsoft.Exchange.Search.Mdb.ni.dll in the .NET native image cache. The cache normally lives under C:\Windows\assembly\NativeImages_* (our background, not from ESET). Legitimate files there are created by the .NET runtime or NGEN, so a write by anything else is the lead.

title: Native image cache file written by unexpected process
status: experimental
description: Derived from ESET description of native image cache abuse (our derivation)
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains: '\assembly\NativeImages_'
    TargetFilename|endswith: '.ni.dll'
  filter_ngen:
    Image|endswith:
      - '\ngen.exe'
      - '\mscorsvw.exe'
      - '\TiWorker.exe'
  condition: selection and not filter_ngen
level: medium
DeviceFileEvents
| where Timestamp > ago(30d)
| where FolderPath has @"\assembly\NativeImages_" and FileName endswith ".ni.dll"
| where ActionType in ("FileCreated","FileModified")
| where InitiatingProcessFileName !in~ ("ngen.exe","mscorsvw.exe","TiWorker.exe")
| project Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine

Native images are generated locally per machine (Microsoft’s NGEN documentation), so we do not suggest comparing their hashes with another server. The writer process and the timestamp, as used above, are the more reliable leads.

Hunt 3: unsigned loads of the reported DLLs and native images

CerealBox is injected into EdgeTransport.exe, but the post does not list API names. This hunt therefore does not detect the injection or arbitrary modules inside EdgeTransport.exe. It only looks for unsigned loads of the two reported wbem DLL names and of native image cache files by the processes listed (our derivation). A legitimate wbemcomn.dll exists in that folder, so expect it to appear unless you filter on signature state.

DeviceImageLoadEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName in~ ("EdgeTransport.exe","wmiprvse.exe","svchost.exe")
| where (FolderPath has @"\System32\wbem\" and FileName in~ ("ncobjapi.dll","wbemcomn.dll"))
    or (FolderPath has @"\assembly\NativeImages_" and FileName endswith ".ni.dll")
| join kind=leftouter (DeviceFileCertificateInfo | project SHA1, IsTrusted, Signer) on SHA1
| where isnull(IsTrusted) or IsTrusted == false
| project Timestamp, DeviceName, InitiatingProcessFileName, FolderPath, FileName, SHA1, Signer

Native images are often unsigned, so the native image branch will be noisy; use it only to rank hosts. ESET does not say the malicious DLLs are unsigned; that is our assumption, and hosts with no certificate record will also match. For Splunk with Sysmon (Event ID 7):

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7
  (Image="*\\EdgeTransport.exe" OR Image="*\\wmiprvse.exe" OR Image="*\\svchost.exe")
  (ImageLoaded="*\\System32\\wbem\\ncobjapi.dll" OR ImageLoaded="*\\System32\\wbem\\wbemcomn.dll"
   OR ImageLoaded="*\\assembly\\NativeImages_*\\*.ni.dll")
  (Signed="false" OR SignatureStatus!="Valid")
| stats count min(_time) as first max(_time) as last by host Image ImageLoaded Hashes

Sysmon rarely runs on Exchange servers by default and image-load logging is noisy, so confirm coverage first (our note).

Hunt 4: requests to the reported paths

CerealNeuron answers on paths that mimic Exchange endpoints. ESET says malformed requests get an Exchange-looking error redirect, so we expect failed probes to be indistinguishable from scanner noise. The reported /owa/sdds/ path is the least common of the three on a normal server (our assumption; verify against your own baseline).

W3CIISLog
| where TimeGenerated > ago(30d)
| where csUriStem startswith "/owa/sdds" or csUriStem startswith "/Autodiscover/ProxyService" or csUriStem startswith "/Microsoft-Server-ActiveSync/Integrated/API"
| summarize hits=count(), clients=dcount(cIP) by csUriStem, csMethod, scStatus
| order by hits desc

A hit proves nothing alone. Look for rare client IPs, POST to a path your tenant does not otherwise use, or a path with a response size pattern unlike neighbours. ESET published no request format, so we cannot offer a content signature.

Hunt 5: staged mail archives and post-compromise commands

ESET says CerealBox stages encrypted mail files that operators later exfiltrate and delete. It gives no file names or location in the blog post, so look generically for new non-standard files written by EdgeTransport.exe and for credential and AD activity from Exchange servers: LSASS or LSA access, mass LDAP queries, and WMI process or TCP listings.

DeviceFileEvents
| where Timestamp > ago(30d) and ActionType == "FileCreated"
| where InitiatingProcessFileName =~ "EdgeTransport.exe"
| where FolderPath !has @"\TransportRoles\"
| project Timestamp, DeviceName, FolderPath, FileName, FileSize

The TransportRoles exclusion is our assumption about where normal queue data lives; adjust it for your install.

Triage

  1. A hit on Hunt 1 or 2 is high priority: preserve the file, its hash and memory of the host before restarting any Exchange service.
  2. Check configured transport agents (Get-TransportAgent), though ESET says CerealBox adds none, so a clean list does not clear the host.
  3. For IOCs, use ESET’s white paper and GitHub repository directly rather than secondary summaries.

For background on the related techniques, see our guides on DLL sideloading and hijacking and webshell deployment on IIS.

References