Netskope Threat Labs

INDICATOR-SHELLCODE Windows Donut x64 loader download attempt

IPS-SWG

1 SID: 61871

First seen
June 2023
Last seen
September 2026

Detects the Donut shellcode loader, which turns managed payloads into position independent shellcode. Spotting these indicators early helps contain an intrusion before cyberattackers expand access.