diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index e3e6d3cee1..88b6fb4b74 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,8 +1,8 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 -version: 30 +version: 31 creation_date: '2021-05-07' -modification_date: '2026-07-20' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -140,6 +140,7 @@ analytic_story: - VIP Keylogger - Phantom Stealer - Starland RAT Campaign + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/executables_or_script_creation_in_temp_path.yml b/detections/endpoint/executables_or_script_creation_in_temp_path.yml index 6f4f9aa1ce..69962abd69 100644 --- a/detections/endpoint/executables_or_script_creation_in_temp_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_temp_path.yml @@ -1,8 +1,8 @@ name: Executables Or Script Creation In Temp Path id: e0422b71-2c05-4f32-8754-01fb415f49c9 -version: 26 +version: 27 creation_date: '2021-05-07' -modification_date: '2026-06-25' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -133,6 +133,7 @@ analytic_story: - RoguePlanet - Salat Stealer - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index 9eed7ce0f7..7c4d31481c 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -1,8 +1,8 @@ name: Non Chrome Process Accessing Chrome Default Dir id: 81263de4-160a-11ec-944f-acde48001122 -version: 20 +version: 21 creation_date: '2021-09-15' -modification_date: '2026-06-25' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -51,6 +51,7 @@ analytic_story: - VIP Keylogger - Salat Stealer - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1555.003 diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index bdd370d7ef..87b1884b1c 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -1,8 +1,8 @@ name: Non Firefox Process Access Firefox Profile Dir id: e6fc13b0-1609-11ec-b533-acde48001122 -version: 20 +version: 21 creation_date: '2021-09-15' -modification_date: '2026-06-25' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -53,6 +53,7 @@ analytic_story: - VIP Keylogger - Salat Stealer - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1555.003 diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml index d3b92a9ed6..cee3e655c7 100644 --- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml +++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml @@ -1,8 +1,8 @@ name: Windows Access Token Manipulation SeDebugPrivilege id: 6ece9ed0-5f92-4315-889d-48560472b188 -version: 23 +version: 24 creation_date: '2022-09-05' -modification_date: '2026-06-08' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -53,6 +53,7 @@ analytic_story: - Tuoni - Gh0st RAT - Salat Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1134.002 diff --git a/detections/endpoint/windows_cloud_sensitive_file_read_access_by_uncommon_process.yml b/detections/endpoint/windows_cloud_sensitive_file_read_access_by_uncommon_process.yml new file mode 100644 index 0000000000..bf909972d7 --- /dev/null +++ b/detections/endpoint/windows_cloud_sensitive_file_read_access_by_uncommon_process.yml @@ -0,0 +1,109 @@ +name: Windows Cloud Sensitive File Read Access By Uncommon Process +id: 313e4f5c-add3-4b4d-8348-6a009ce5fe40 +version: 1 +creation_date: '2026-08-19' +modification_date: '2026-08-19' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: |- + This analytic detects uncommon processes reading or requesting read access to sensitive files from cloud providers on Windows endpoints. + It monitors Windows Security Event 4663 for ReadData (AccessMask 0x1) operations against sensitive files from cloud providers such as Azure. + Access by any process outside the known toolchain may indicate credential theft or cloud identity reconnaissance activity, including infostealer behavior such as one observed in Vidar Stealer variants. + This detection currently only supports Azure sensitive files, but will be extended to support other cloud providers in the future. +data_source: + - Windows Event Log Security 4663 +search: |- + `wineventlog_security` + EventCode=4663 + ObjectType="File" + NOT process_path IN ( + "*:\\AppData\\Local\\Programs\\Python\\*\\python.exe", + "*:\\AppData\\Local\\Python\\bin\\python.exe", + "*:\\AppData\\Local\\Python\\pythoncore-*\\python.exe", + "*:\\Program Files\\Azure Dev CLI\\azd.exe", + "*:\\Program Files\\Microsoft SDKs\\Azure\\CLI2\\python.exe", + "*:\\Program Files\\Microsoft VS Code\\Code.exe", + "*:\\Program Files\\nodejs\\node.exe", + "*:\\Program Files\\PowerShell\\7-preview\\pwsh.exe", + "*:\\Program Files\\PowerShell\\7\\pwsh.exe", + "*:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", + "*:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", + "*\\.azd\\bin\\azd.exe", + "*\\AppData\\Local\\Microsoft\\powershell\\pwsh.exe", + "*\\AppData\\Local\\Programs\\Azure Dev CLI\\azd.exe", + "*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe" + ) + ObjectName IN ( + "*\\.azure\\accessTokens.json", + "*\\.azure\\azureProfile.json", + "*\\.azure\\msal_token_cache.json", + "*\\.azure\\TokenCache.dat", + "*\\Windows Azure Powershell\\TokenCache.dat" + ) + + ``` + We select only read-related operations: + 0x1 = ReadData (or ListDirectory) + ``` + + | eval AccessMask_ = tonumber(AccessMask, 16) + | where (bit_and(AccessMask_, 1) != 0) + + | stats count min(_time) as firstTime + max(_time) as lastTime + by signature_id signature + ObjectType file_path file_name + process_path process_name process_id + AccessMask src_user dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_cloud_sensitive_file_read_access_by_uncommon_process_filter` +how_to_implement: |- + To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. + To enable Event ID 4663, enable object access auditing through Group Policy: Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Object Access > Audit File System, then enable Success auditing. Enable Failure auditing if your environment also requires denied access attempts. + Event ID 4663 is only generated for files with a matching System Access Control List (SACL), so configure auditing on the relevant sensitive files from cloud providers. +known_false_positives: |- + False positives are expected from legitimate tooling. + The detection excludes the Azure CLI bundled Python interpreter, Windows PowerShell, PowerShell 7+, VS Code, and the Azure Developer CLI by process path. + Residual false positives may arise from CI/CD agents (e.g., Azure DevOps self-hosted runners, GitHub Actions runners) that invoke az or Azure PowerShell from non-standard install paths not covered by the exclusion list, backup or DLP agents that scan user profile directories, and custom automation scripts that shell out to Azure CLI from an unexpected working directory. + Tune by adding confirmed-legitimate process paths and file paths to the companion filter macro windows_cloud_sensitive_file_read_access_by_uncommon_process_filter. +references: + - https://www.trendmicro.com/en_us/research/25/j/how-vidar-stealer-2-upgrades-infostealer-capabilities.html +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: An uncommon process [$process_name$] accessing sensitive file [$file_path$] with AccessMask [$AccessMask$] on $dest$ +threat_objects: + - field: process_name + type: process_name +analytic_story: + - Vidar Stealer +asset_type: Endpoint +mitre_attack_id: + - T1528 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1528/vidar_azure_file_access/azure_vidar_access.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml index e4f8a81b82..231b1b6cbb 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml @@ -1,8 +1,8 @@ name: Windows Credentials from Password Stores Chrome Extension Access id: 2e65afe0-9a75-4487-bd87-ada9a9f1b9af -version: 13 +version: 14 creation_date: '2023-05-02' -modification_date: '2026-06-25' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -71,6 +71,7 @@ analytic_story: - 0bj3ctivity Stealer - BlankGrabber Stealer - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml index 20b4759d21..1d58baaa71 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml @@ -1,8 +1,8 @@ name: Windows Credentials from Password Stores Chrome LocalState Access id: 3b1d09a8-a26f-473e-a510-6c6613573657 -version: 23 +version: 24 creation_date: '2023-05-02' -modification_date: '2026-06-25' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -85,6 +85,7 @@ analytic_story: - VIP Keylogger - Salat Stealer - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml index 57cf84d660..5656489fbe 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml @@ -1,8 +1,8 @@ name: Windows Credentials from Password Stores Chrome Login Data Access id: 0d32ba37-80fc-4429-809c-0ba15801aeaf -version: 23 +version: 24 creation_date: '2023-05-02' -modification_date: '2026-07-08' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -85,6 +85,7 @@ analytic_story: - VIP Keylogger - Salat Stealer - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_disable_or_stop_browser_process.yml b/detections/endpoint/windows_disable_or_stop_browser_process.yml index 51490b8924..354d3e7a7d 100644 --- a/detections/endpoint/windows_disable_or_stop_browser_process.yml +++ b/detections/endpoint/windows_disable_or_stop_browser_process.yml @@ -1,8 +1,8 @@ name: Windows Disable or Stop Browser Process id: 220d34b7-b6c7-45fe-8dbb-c35cdd9fe6d5 -version: 14 +version: 15 creation_date: '2024-10-18' -modification_date: '2026-06-25' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: TTP @@ -57,6 +57,7 @@ analytic_story: - BlankGrabber Stealer - Salat Stealer - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1685 diff --git a/detections/endpoint/windows_indicator_removal_via_rmdir.yml b/detections/endpoint/windows_indicator_removal_via_rmdir.yml index fdeaac6b08..e86c4aa350 100644 --- a/detections/endpoint/windows_indicator_removal_via_rmdir.yml +++ b/detections/endpoint/windows_indicator_removal_via_rmdir.yml @@ -1,8 +1,8 @@ name: Windows Indicator Removal Via Rmdir id: c4566d2c-b094-48a1-9c59-d66e22065560 -version: 12 +version: 13 creation_date: '2022-12-06' -modification_date: '2026-05-13' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -35,6 +35,7 @@ analytic_story: - DarkGate Malware - APT37 Rustonotto and FadeStealer - ZOVWiper + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1070 diff --git a/detections/endpoint/windows_process_injection_remote_thread.yml b/detections/endpoint/windows_process_injection_remote_thread.yml index e50e55a325..3a06b8b7ed 100644 --- a/detections/endpoint/windows_process_injection_remote_thread.yml +++ b/detections/endpoint/windows_process_injection_remote_thread.yml @@ -1,8 +1,8 @@ name: Windows Process Injection Remote Thread id: 8a618ade-ca8f-4d04-b972-2d526ba59924 -version: 14 +version: 15 creation_date: '2022-10-28' -modification_date: '2026-06-29' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: TTP @@ -72,6 +72,7 @@ analytic_story: - Earth Alux - Water Gamayun - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1055.002 diff --git a/detections/endpoint/windows_query_registry_uninstall_program_list.yml b/detections/endpoint/windows_query_registry_uninstall_program_list.yml index d2f45279fe..d1ac45a907 100644 --- a/detections/endpoint/windows_query_registry_uninstall_program_list.yml +++ b/detections/endpoint/windows_query_registry_uninstall_program_list.yml @@ -1,8 +1,8 @@ name: Windows Query Registry UnInstall Program List id: 535fd4fc-7151-4062-9d7e-e896bea77bf6 -version: 10 +version: 11 creation_date: '2023-05-02' -modification_date: '2026-05-13' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -33,6 +33,7 @@ analytic_story: - StealC Stealer - RedLine Stealer - Meduza Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_screen_capture_in_temp_folder.yml b/detections/endpoint/windows_screen_capture_in_temp_folder.yml index 02e18be49a..c9aa8093d1 100644 --- a/detections/endpoint/windows_screen_capture_in_temp_folder.yml +++ b/detections/endpoint/windows_screen_capture_in_temp_folder.yml @@ -1,8 +1,8 @@ name: Windows Screen Capture in TEMP folder id: 00524d1f-a032-46f5-9108-e7d9f01bfb3c -version: 12 +version: 13 creation_date: '2024-10-18' -modification_date: '2026-05-13' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: TTP @@ -37,6 +37,7 @@ analytic_story: - APT37 Rustonotto and FadeStealer - Hellcat Ransomware - VIP Keylogger + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1113 diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml index 48ec64c62e..bae7c63144 100644 --- a/detections/endpoint/windows_suspicious_process_file_path.yml +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -1,8 +1,8 @@ name: Windows Suspicious Process File Path id: ecddae4e-3d4b-41e2-b3df-e46a88b38521 -version: 27 +version: 28 creation_date: '2021-05-07' -modification_date: '2026-07-20' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: TTP @@ -97,6 +97,7 @@ analytic_story: - RoguePlanet - Phantom Stealer - Starland RAT Campaign + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1543 diff --git a/stories/vidar_stealer.yml b/stories/vidar_stealer.yml new file mode 100644 index 0000000000..7ff25c7085 --- /dev/null +++ b/stories/vidar_stealer.yml @@ -0,0 +1,34 @@ +name: Vidar Stealer +id: 220047e4-6075-40bc-846f-ab737e6a4dc8 +version: 1 +creation_date: '2026-07-31' +modification_date: '2026-07-31' +author: Teoderick Contreras, Splunk +status: production +description: |- + The Vidar Stealer analytic story provides detection and investigation content for identifying and responding to threats associated with the Vidar information stealer on Windows endpoints. + Vidar is a commodity infostealer sold as malware-as-a-service (MaaS) on underground forums, capable of harvesting credentials, browser cookies, saved passwords, cryptocurrency wallet data, and cloud profile metadata from infected systems. + Recent variants have been observed targeting Azure CLI profile data stored in azureProfile.json, enabling cloud identity reconnaissance and potential account takeover. + Vidar also loads legitimate Mozilla NSS and mozglue DLLs to decrypt browser-stored credentials without raising typical AV signatures. + This story leverages endpoint telemetry from Windows Security Event logs and Sysmon to detect suspicious file access, unusual DLL loading patterns, and process behaviors consistent with Vidar activity. + Security teams can use these analytics to identify early-stage Vidar compromise, isolate affected hosts, and prevent credential exfiltration to attacker-controlled command-and-control infrastructure. +narrative: |- + Vidar Stealer is an active commodity threat targeting Windows users across multiple sectors, distributed primarily through phishing campaigns, malvertising, trojanized software downloads, and cracked application bundles. + Once executed, Vidar performs rapid system and credential reconnaissance before exfiltrating harvested data to its command-and-control (C2) server, often within minutes of initial execution. + A notable capability of Vidar is its abuse of legitimate Mozilla NSS libraries (nss3.dll, mozglue.dll) to decrypt browser-stored credentials from Chromium and Firefox-based browsers without triggering conventional security controls. + By side-loading these trusted DLLs from an unexpected process context, Vidar bypasses many endpoint detection signatures that rely on browser process lineage. + More recent Vidar variants have extended their reconnaissance scope to include Azure CLI artifacts, specifically targeting the azureProfile.json file stored in the user profile directory. + This file contains Azure subscription identifiers, tenant IDs, and environment metadata that attackers can use to enumerate accessible cloud resources and facilitate lateral movement into Azure-hosted infrastructure. + Telemetry from affected endpoints typically shows non-Azure processes opening azureProfile.json with read access (Event 4663, AccessMask 0x1), followed by data staging and outbound HTTPS exfiltration. + Detection of these behaviors early in the infection chain gives defenders the opportunity to contain the compromise before credentials reach attacker infrastructure, preventing downstream account takeovers, financial fraud, and secondary malware deployment. +references: + - https://www.trendmicro.com/en_us/research/25/j/how-vidar-stealer-2-upgrades-infostealer-capabilities.html + - https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar + - https://www.esentire.com/blog/vidar-stealer-abusing-social-media-for-c2 +category: + - Malware +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +usecase: Advanced Threat Detection