vidar

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -1,8 +1,8 @@
 name: Executables Or Script Creation In Suspicious Path
 id: a7e3f0f0-ae42-11eb-b245-acde48001122
-version: 30
+version: 31
 creation_date: '2021-05-07'
-modification_date: '2026-07-20'
+modification_date: '2026-08-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -140,6 +140,7 @@ analytic_story:
     - VIP Keylogger
     - Phantom Stealer
     - Starland RAT Campaign
+    - Vidar Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1036

detections/endpoint/executables_or_script_creation_in_temp_path.yml

@@ -1,8 +1,8 @@
 name: Executables Or Script Creation In Temp Path
 id: e0422b71-2c05-4f32-8754-01fb415f49c9
-version: 26
+version: 27
 creation_date: '2021-05-07'
-modification_date: '2026-06-25'
+modification_date: '2026-08-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -133,6 +133,7 @@ analytic_story:
     - RoguePlanet
     - Salat Stealer
     - Phantom Stealer
+    - Vidar Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1036

detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml

@@ -1,8 +1,8 @@
 name: Non Chrome Process Accessing Chrome Default Dir
 id: 81263de4-160a-11ec-944f-acde48001122
-version: 20
+version: 21
 creation_date: '2021-09-15'
-modification_date: '2026-06-25'
+modification_date: '2026-08-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -51,6 +51,7 @@ analytic_story:
     - VIP Keylogger
     - Salat Stealer
     - Phantom Stealer
+    - Vidar Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1555.003

detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml

@@ -1,8 +1,8 @@
 name: Non Firefox Process Access Firefox Profile Dir
 id: e6fc13b0-1609-11ec-b533-acde48001122
-version: 20
+version: 21
 creation_date: '2021-09-15'
-modification_date: '2026-06-25'
+modification_date: '2026-08-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -53,6 +53,7 @@ analytic_story:
     - VIP Keylogger
     - Salat Stealer
     - Phantom Stealer
+    - Vidar Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1555.003

detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml

@@ -1,8 +1,8 @@
 name: Windows Access Token Manipulation SeDebugPrivilege
 id: 6ece9ed0-5f92-4315-889d-48560472b188
-version: 23
+version: 24
 creation_date: '2022-09-05'
-modification_date: '2026-06-08'
+modification_date: '2026-08-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -53,6 +53,7 @@ analytic_story:
     - Tuoni
     - Gh0st RAT
     - Salat Stealer
+    - Vidar Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1134.002

detections/endpoint/windows_cloud_sensitive_file_read_access_by_uncommon_process.yml

@@ -0,0 +1,109 @@
+name: Windows Cloud Sensitive File Read Access By Uncommon Process
+id: 313e4f5c-add3-4b4d-8348-6a009ce5fe40
+version: 1
+creation_date: '2026-08-19'
+modification_date: '2026-08-19'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+description: |-
+    This analytic detects uncommon processes reading or requesting read access to sensitive files from cloud providers on Windows endpoints.
+    It monitors Windows Security Event 4663 for ReadData (AccessMask 0x1) operations against sensitive files from cloud providers such as Azure.
+    Access by any process outside the known toolchain may indicate credential theft or cloud identity reconnaissance activity, including infostealer behavior such as one observed in Vidar Stealer variants.
+    This detection currently only supports Azure sensitive files, but will be extended to support other cloud providers in the future.
+data_source:
+    - Windows Event Log Security 4663
+search: |-
+    `wineventlog_security`
+    EventCode=4663
+    ObjectType="File"
+    NOT process_path IN (
+        "*:\\AppData\\Local\\Programs\\Python\\*\\python.exe",
+        "*:\\AppData\\Local\\Python\\bin\\python.exe",
+        "*:\\AppData\\Local\\Python\\pythoncore-*\\python.exe",
+        "*:\\Program Files\\Azure Dev CLI\\azd.exe",
+        "*:\\Program Files\\Microsoft SDKs\\Azure\\CLI2\\python.exe",
+        "*:\\Program Files\\Microsoft VS Code\\Code.exe",
+        "*:\\Program Files\\nodejs\\node.exe",
+        "*:\\Program Files\\PowerShell\\7-preview\\pwsh.exe",
+        "*:\\Program Files\\PowerShell\\7\\pwsh.exe",
+        "*:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
+        "*:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe",
+        "*\\.azd\\bin\\azd.exe",
+        "*\\AppData\\Local\\Microsoft\\powershell\\pwsh.exe",
+        "*\\AppData\\Local\\Programs\\Azure Dev CLI\\azd.exe",
+        "*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe"
+    )
+    ObjectName IN (
+        "*\\.azure\\accessTokens.json",
+        "*\\.azure\\azureProfile.json",
+        "*\\.azure\\msal_token_cache.json",
+        "*\\.azure\\TokenCache.dat",
+        "*\\Windows Azure Powershell\\TokenCache.dat"
+    )
+
+    ```
+    We select only read-related operations:
+        0x1 = ReadData (or ListDirectory)
+    ```
+
+    | eval AccessMask_ = tonumber(AccessMask, 16)
+    | where (bit_and(AccessMask_, 1) != 0)
+
+    | stats count min(_time) as firstTime
+                  max(_time) as lastTime
+      by signature_id signature
+         ObjectType file_path file_name
+         process_path process_name process_id
+         AccessMask src_user dest
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `windows_cloud_sensitive_file_read_access_by_uncommon_process_filter`
+how_to_implement: |-
+    To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663.
+    To enable Event ID 4663, enable object access auditing through Group Policy: Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Object Access > Audit File System, then enable Success auditing. Enable Failure auditing if your environment also requires denied access attempts.
+    Event ID 4663 is only generated for files with a matching System Access Control List (SACL), so configure auditing on the relevant sensitive files from cloud providers.
+known_false_positives: |-
+    False positives are expected from legitimate tooling.
+    The detection excludes the Azure CLI bundled Python interpreter, Windows PowerShell, PowerShell 7+, VS Code, and the Azure Developer CLI by process path.
+    Residual false positives may arise from CI/CD agents (e.g., Azure DevOps self-hosted runners, GitHub Actions runners) that invoke az or Azure PowerShell from non-standard install paths not covered by the exclusion list, backup or DLP agents that scan user profile directories, and custom automation scripts that shell out to Azure CLI from an unexpected working directory.
+    Tune by adding confirmed-legitimate process paths and file paths to the companion filter macro windows_cloud_sensitive_file_read_access_by_uncommon_process_filter.
+references:
+    - https://www.trendmicro.com/en_us/research/25/j/how-vidar-stealer-2-upgrades-infostealer-capabilities.html
+drilldown_searches:
+    - name: View the detection results for - "$dest$"
+      search: '%original_detection_search% | search  dest = "$dest$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+intermediate_findings:
+    entities:
+        - field: dest
+          type: system
+          score: 20
+          message: An uncommon process [$process_name$] accessing sensitive file [$file_path$] with AccessMask [$AccessMask$] on $dest$
+threat_objects:
+    - field: process_name
+      type: process_name
+analytic_story:
+    - Vidar Stealer
+asset_type: Endpoint
+mitre_attack_id:
+    - T1528
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1528/vidar_azure_file_access/azure_vidar_access.log
+          source: XmlWinEventLog:Security
+          sourcetype: XmlWinEventLog
+      test_type: unit

detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml

@@ -1,8 +1,8 @@
 name: Windows Credentials from Password Stores Chrome Extension Access
 id: 2e65afe0-9a75-4487-bd87-ada9a9f1b9af
-version: 13
+version: 14
 creation_date: '2023-05-02'
-modification_date: '2026-06-25'
+modification_date: '2026-08-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -71,6 +71,7 @@ analytic_story:
     - 0bj3ctivity Stealer
     - BlankGrabber Stealer
     - Phantom Stealer
+    - Vidar Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1012

detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml

@@ -1,8 +1,8 @@
 name: Windows Credentials from Password Stores Chrome LocalState Access
 id: 3b1d09a8-a26f-473e-a510-6c6613573657
-version: 23
+version: 24
 creation_date: '2023-05-02'
-modification_date: '2026-06-25'
+modification_date: '2026-08-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -85,6 +85,7 @@ analytic_story:
     - VIP Keylogger
     - Salat Stealer
     - Phantom Stealer
+    - Vidar Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1012

detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml

@@ -1,8 +1,8 @@
 name: Windows Credentials from Password Stores Chrome Login Data Access
 id: 0d32ba37-80fc-4429-809c-0ba15801aeaf
-version: 23
+version: 24
 creation_date: '2023-05-02'
-modification_date: '2026-07-08'
+modification_date: '2026-08-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -85,6 +85,7 @@ analytic_story:
     - VIP Keylogger
     - Salat Stealer
     - Phantom Stealer
+    - Vidar Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1012

detections/endpoint/windows_disable_or_stop_browser_process.yml

@@ -1,8 +1,8 @@
 name: Windows Disable or Stop Browser Process
 id: 220d34b7-b6c7-45fe-8dbb-c35cdd9fe6d5
-version: 14
+version: 15
 creation_date: '2024-10-18'
-modification_date: '2026-06-25'
+modification_date: '2026-08-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -57,6 +57,7 @@ analytic_story:
     - BlankGrabber Stealer
     - Salat Stealer
     - Phantom Stealer
+    - Vidar Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1685

detections/endpoint/windows_indicator_removal_via_rmdir.yml

@@ -1,8 +1,8 @@
 name: Windows Indicator Removal Via Rmdir
 id: c4566d2c-b094-48a1-9c59-d66e22065560
-version: 12
+version: 13
 creation_date: '2022-12-06'
-modification_date: '2026-05-13'
+modification_date: '2026-08-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -35,6 +35,7 @@ analytic_story:
     - DarkGate Malware
     - APT37 Rustonotto and FadeStealer
     - ZOVWiper
+    - Vidar Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1070

detections/endpoint/windows_process_injection_remote_thread.yml

@@ -1,8 +1,8 @@
 name: Windows Process Injection Remote Thread
 id: 8a618ade-ca8f-4d04-b972-2d526ba59924
-version: 14
+version: 15
 creation_date: '2022-10-28'
-modification_date: '2026-06-29'
+modification_date: '2026-08-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -72,6 +72,7 @@ analytic_story:
     - Earth Alux
     - Water Gamayun
     - Phantom Stealer
+    - Vidar Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1055.002

detections/endpoint/windows_query_registry_uninstall_program_list.yml

@@ -1,8 +1,8 @@
 name: Windows Query Registry UnInstall Program List
 id: 535fd4fc-7151-4062-9d7e-e896bea77bf6
-version: 10
+version: 11
 creation_date: '2023-05-02'
-modification_date: '2026-05-13'
+modification_date: '2026-08-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -33,6 +33,7 @@ analytic_story:
     - StealC Stealer
     - RedLine Stealer
     - Meduza Stealer
+    - Vidar Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1012

detections/endpoint/windows_screen_capture_in_temp_folder.yml

@@ -1,8 +1,8 @@
 name: Windows Screen Capture in TEMP folder
 id: 00524d1f-a032-46f5-9108-e7d9f01bfb3c
-version: 12
+version: 13
 creation_date: '2024-10-18'
-modification_date: '2026-05-13'
+modification_date: '2026-08-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -37,6 +37,7 @@ analytic_story:
     - APT37 Rustonotto and FadeStealer
     - Hellcat Ransomware
     - VIP Keylogger
+    - Vidar Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1113

detections/endpoint/windows_suspicious_process_file_path.yml

@@ -1,8 +1,8 @@
 name: Windows Suspicious Process File Path
 id: ecddae4e-3d4b-41e2-b3df-e46a88b38521
-version: 27
+version: 28
 creation_date: '2021-05-07'
-modification_date: '2026-07-20'
+modification_date: '2026-08-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -97,6 +97,7 @@ analytic_story:
     - RoguePlanet
     - Phantom Stealer
     - Starland RAT Campaign
+    - Vidar Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1543