TencShell - Donut Shellcode Woff Masquerade (T1036.008)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•1

Identifies outbound HTTP GET requests fetching masqueraded Donut shellcode disguised as .woff web font files from non-browser processes. This rule specifically looks for network events where the remote URL ends with '.woff' and the initiating process is not a common web browser (chrome.exe, msedge.exe, firefox.exe).