i2p/anydeskrce-something

Fork 0

Files

T

i2p 2f6dd314cb initial commit

2026-08-27 11:22:37 -06:00

26 KiB

Raw Permalink Blame History

Defending Against Modern Infostealers: Actionable Defense Guide (2025-2026)

Executive Summary

Infostealers stole 1.8 billion credentials from 5.8 million devices in H1 2025 alone -- an 800% increase from prior years. Stolen credentials now drive 86% of all breaches and are the #2 initial access vector (22% of confirmed breaches). 54% of ransomware victims had prior credential exposure in stealer logs. This guide covers what actually works, what doesn't, and where defenders should focus.

1. What Actually Stops Modern Stealers vs. What Doesn't

What Works

Defense	Why It Works	Effectiveness
DBSC (Device Bound Session Credentials)	Binds session cookies to TPM-backed keys; stolen cookies are useless on other devices	High -- directly counters the #1 stealer target
Passkeys / FIDO2	Eliminates passwords entirely; nothing to steal	Very High -- complete removal of attack surface
Short-lived session tokens (< 1hr TTL)	Reduces window for stolen token replay	Medium-High -- limits damage even if theft occurs
Application allowlisting + Smart App Control	Blocks unknown/unsigned binaries before execution	High -- prevents initial execution
ASR rules in Block mode	Blocks LSASS access, Office child processes, script abuse	High -- direct mitigation of common techniques
Credential Guard (VBS)	Isolates NTLM hashes and Kerberos TGTs in secure enclave	High for OS creds -- but stealers target browsers instead
HVCI	Prevents unsigned kernel code execution; forces data-only attacks	High -- eliminates entire classes of kernel exploits
CET Shadow Stack	Hardware-enforced return address integrity; kills ROP chains	High for exploit-based delivery; less relevant to social engineering delivery
Browser isolation (RBI)	Credentials never touch endpoint; phishing pages can't capture input	Very High for targeted scenarios
Zero Trust + microsegmentation	Limits lateral movement even with valid stolen creds	High -- 60% breach reduction (Gartner 2025)

What Doesn't Work (Alone)

Defense	Why It Falls Short
Signature-based AV only	Stealers repack/morph constantly; 66% evade EDR
MFA without device binding	Session cookies bypass MFA entirely via anti-detect browsers
Credential Guard alone	Protects OS creds but not browser-stored passwords, cookies, tokens
Network perimeter firewalls	Stealers exfiltrate over HTTPS to legitimate-looking C2
User training alone	Social engineering constantly evolves; one click is all it takes
App-Bound Encryption (Chrome, legacy)	Already bypassed by multiple stealer families; being replaced by DBSC

2. Detection Rules and Signatures

2.1 YARA Rules

Elastic Security provides production-ready YARA rules:

Windows_Infostealer_Generic.yar -- generic infostealer behavioral patterns
Windows_Trojan_Lumma.yar -- Lumma-specific detection
Repository: github.com/elastic/protections-artifacts/tree/main/yara/rules/

VMRay maintains updated YARA rules and configuration extractors for Lumma, Vidar 2.0, StealC, and emerging families, with monthly detection highlight releases.

Key YARA detection patterns for infostealers:

rule Infostealer_Browser_DB_Access {
    meta:
        description = "Detects binary accessing browser credential databases"
    strings:
        $s1 = "Login Data" ascii wide
        $s2 = "logins.json" ascii wide
        $s3 = "key4.db" ascii wide
        $s4 = "Cookies" ascii wide
        $s5 = "Web Data" ascii wide
        $s6 = "Local State" ascii wide
        $chrome_path = "\\Google\\Chrome\\User Data\\" ascii wide
        $firefox_path = "\\Mozilla\\Firefox\\Profiles\\" ascii wide
        $edge_path = "\\Microsoft\\Edge\\User Data\\" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        3 of ($s*) and
        1 of ($chrome_path, $firefox_path, $edge_path)
}

rule Infostealer_Crypto_Wallet_Theft {
    meta:
        description = "Detects binary targeting cryptocurrency wallets"
    strings:
        $w1 = "wallet.dat" ascii wide
        $w2 = "exodus" ascii wide nocase
        $w3 = "metamask" ascii wide nocase
        $w4 = "phantom" ascii wide nocase
        $w5 = "electrum" ascii wide nocase
        $w6 = "\\Ethereum\\keystore" ascii wide
    condition:
        uint16(0) == 0x5A4D and 3 of them
}

2.2 Sigma Rules

LSASS Credential Dumping:

title: Suspicious LSASS Process Access
id: a2f29a02-0bf0-4730-b2d2-d8b38e0f5e48
status: stable
logsource:
    category: process_access
    product: windows
detection:
    selection:
        TargetImage|endswith: '\lsass.exe'
        GrantedAccess|contains:
            - '0x1010'
            - '0x1410'
            - '0x1038'
            - '0x1438'
            - '0x143a'
    filter_system:
        SourceImage|endswith:
            - '\wmiprvse.exe'
            - '\taskmgr.exe'
            - '\procexp64.exe'
            - '\MsMpEng.exe'
    condition: selection and not filter_system
level: high

Browser Credential Store Access by Non-Browser Process:

title: Non-Browser Process Accessing Browser Credential Store
logsource:
    category: file_access
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - '\Google\Chrome\User Data\Default\Login Data'
            - '\Google\Chrome\User Data\Default\Cookies'
            - '\Google\Chrome\User Data\Local State'
            - '\Microsoft\Edge\User Data\Default\Login Data'
            - '\Mozilla\Firefox\Profiles\'
    filter_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
            - '\opera.exe'
    condition: selection and not filter_browsers
level: high

HVCI Tampering Detection (from SigmaHQ):

title: HVCI Registry Tampering via Command Line
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'HypervisorEnforcedCodeIntegrity'
            - 'Enabled'
            - '0'
    condition: selection
level: critical

2.3 KQL / Sentinel Queries

Suspicious browser credential file access:

DeviceFileEvents
| where FileName in ("Login Data", "Cookies", "Web Data", "Local State", "key4.db", "logins.json")
| where InitiatingProcessFileName !in ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe", "update.exe")
| where ActionType == "FileRead" or ActionType == "FileModified"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath
| sort by Timestamp desc

LSASS access from unusual processes:

DeviceEvents
| where ActionType == "OpenProcessApiCall"
| where FileName == "lsass.exe"
| where InitiatingProcessFileName !in ("MsMpEng.exe", "csrss.exe", "wininit.exe", "svchost.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine

Chrome remote debugging abuse:

DeviceProcessEvents
| where ProcessCommandLine has "--remote-debugging-port"
    or ProcessCommandLine has "--remote-allow-origins"
| where InitiatingProcessFileName != "chrome.exe"
| project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessFileName

Suspicious data exfiltration (stealer C2 pattern):

DeviceNetworkEvents
| where RemotePort in (443, 80)
| where InitiatingProcessFileName !in ("chrome.exe", "msedge.exe", "firefox.exe", "svchost.exe", "OneDrive.exe")
| where RemoteUrl !has "microsoft.com" and RemoteUrl !has "windows.com"
| summarize TotalBytes=sum(SentBytes), ConnectionCount=count() by InitiatingProcessFileName, RemoteUrl, bin(Timestamp, 5m)
| where TotalBytes > 1000000 or ConnectionCount > 50

3. Behavioral Indicators That Are Hard for Stealers to Avoid

These are unavoidable actions that any infostealer must perform, making them high-fidelity detection opportunities:

3.1 File Access (Must Touch These Files)

Target	File Paths	Detection Method
Chrome passwords	`%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data`	Sysmon Event ID 11, file access audit
Chrome cookies	`%LOCALAPPDATA%\Google\Chrome\User Data\Default\Cookies`	Same
Chrome local state (encryption key)	`%LOCALAPPDATA%\Google\Chrome\User Data\Local State`	Same
Firefox credentials	`%APPDATA%\Mozilla\Firefox\Profiles\*\logins.json`, `key4.db`	Same
Edge passwords	`%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data`	Same
Crypto wallets	Various `wallet.dat`, extension data	FileSystemWatcher / Sysmon

Key principle: Any process other than the browser itself reading these files is suspicious. This is a high-signal, low-noise detection.

3.2 API Calls (Must Make These Calls)

Action	API/Syscall	Detection
LSASS memory read	`OpenProcess` with `PROCESS_VM_READ` on lsass.exe	Sysmon EventCode 10 with GrantedAccess 0x1010/0x1410
Chrome DPAPI decryption	`CryptUnprotectData`	ETW tracing on DPAPI provider
SQLite database copy (bypass file lock)	`CreateFile` + `DuplicateHandle` or `Volume Shadow Copy`	Handle duplication to browser DB files
Headless browser spawn	Chrome with `--headless`, `--remote-debugging-port`	Process creation monitoring
IElevator COM access	Non-browser process calling `IElevator` interface	COM object access monitoring

3.3 Process Behavior Patterns

Rapid sequential access to multiple browser profiles/credential stores within seconds
Short-lived process that accesses credential stores then makes outbound HTTPS connection
Non-interactive process spawned from temp/download directory accessing credential files
Process injection into browser process from non-browser parent
Clipboard monitoring (keylogger component) -- SetClipboardViewer / AddClipboardFormatListener

4. OS-Level Mitigations

4.1 Intel CET (Control-flow Enforcement Technology)

What it does: Hardware shadow stack prevents ROP/JOP exploit chains. The CPU maintains a separate shadow stack of return addresses that attackers cannot modify.

Impact on stealers: Primarily affects exploit-based delivery (drive-by downloads, document exploits). Less effective against social-engineering delivery (user runs malicious exe). When combined with HVCI, forces attackers into data-only attack patterns.

Deployment: Requires Intel 11th gen+ or AMD Zen 3+ CPU. Windows 11 22H2+ supports kernel-mode CET. Enable via Windows Security > Device Security > Core Isolation.

4.2 HVCI (Hypervisor-Protected Code Integrity)

What it does: Uses VBS hypervisor to prevent unsigned code execution in kernel mode. Eliminates RWX memory in kernel space.

Impact on stealers: Blocks vulnerable driver abuse (BYOVD) unless driver is signed. Prevents kernel rootkits that would disable EDR. Forces attackers to user-mode only operations. Enabled by default in Windows 11 22H2+ and Server 2025.

Critical: Monitor for attempts to disable HVCI via registry tampering (HypervisorEnforcedCodeIntegrity set to 0).

4.3 ACG (Arbitrary Code Guard)

What it does: Prevents dynamic code generation and modification in protected processes. Enforces W^X (write XOR execute) in user mode.

Impact on stealers: Prevents reflective DLL injection and shellcode execution in ACG-protected processes. Browsers (Edge, Chrome) use ACG in renderer processes.

4.4 CFG (Control Flow Guard)

What it does: Validates indirect call targets against a bitmap of valid targets at compile time.

Impact on stealers: Prevents hijacking of function pointers in protected binaries. Combined with CET, provides comprehensive control-flow integrity.

4.5 Credential Guard (VBS-based LSASS isolation)

What it does: Moves NTLM hashes and Kerberos TGTs into a VBS-protected enclave. LSASS runs in isolated mode.

Impact on stealers: Completely defeats Mimikatz-style LSASS dumping for domain credentials. Critical limitation: Does NOT protect browser-stored credentials, cookies, or session tokens -- which is what modern stealers primarily target. Must be paired with browser-level defenses.

Deployment: Enabled by default in Windows 11 Enterprise 22H2+. Check with msinfo32 > Credential Guard status.

4.6 Smart App Control (SAC)

What it does: Cloud-backed reputation check blocks unknown/unsigned binaries before execution. Uses AI behavioral analysis for borderline cases.

Impact on stealers: Strong first-line defense against stealer execution. Blocks binaries not seen by Microsoft's telemetry. As of Windows 11 24H2/25H2, can be toggled without OS reinstall.

Limitations: No per-app exception mechanism. Sophisticated stealers may use signed binaries, living-off-the-land techniques, or supply chain compromise to bypass.

5. Browser-Level Mitigations

5.1 DBSC (Device Bound Session Credentials) -- THE KEY DEFENSE

Status: Chrome open beta (July 2025+). Second origin trial October 2025 - February 2026. W3C First Public Working Draft published 2025.

How it works:

Browser generates TPM-backed keypair during login
Server issues short-lived session cookie
On cookie expiry, browser proves private key possession before refresh
Stolen cookie is useless on another device (no TPM private key)

Enterprise deployment: Available for Google Workspace admins. Enable via Admin Console > Security > Session Binding.

Limitations:

Currently Chrome on Windows only
Requires TPM 2.0
Does not prevent on-device session abuse while attacker is resident
Requires server-side adoption

5.2 App-Bound Encryption (Chrome, legacy)

Chrome 127+ encrypted cookies with a key bound to the app identity. Already bypassed by multiple stealer families (Lumma, Vidar, MeduzaStealer). Being replaced by DBSC. Not a reliable defense in 2025+.

5.3 Remote Debugging Lockdown

Chrome M144+: Shows user permission dialog when any process requests remote debugging session. No longer silently allows --remote-debugging-port.

Enterprise policy: Set RemoteDebuggingAllowed to false in Chrome enterprise policy. Monitor for --remote-debugging-port in process command lines.

5.4 Enterprise Browser Isolation (RBI)

How it works: Web content executes on remote server; only rendered pixels reach endpoint. Credentials autofilled from vault never exist on endpoint.

Best for:

High-value targets (executives, finance, IT admins)
Accessing sensitive SaaS applications
Unknown/risky websites

Leading solutions: Zscaler, Cisco Umbrella RBI, Keeper (PAM-integrated), Forcepoint RBI.

6. Enterprise Controls That Work

Priority 1: Immediate Actions (Week 1-2)

Enable ASR rules in Block mode:
- Block credential stealing from lsass.exe (now default Block in Defender)
- Block executable content from email client and webmail
- Block Office applications from creating child processes
- Block untrusted and unsigned processes that run from USB

Enable LSASS PPL (Protected Process Light):

Registry: HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Value: RunAsPPL = 1 (DWORD)

Deploy Sysmon with credential-theft-focused config:
- Event ID 10: Process Access (filter for lsass.exe targets)
- Event ID 11: File Create (browser credential paths)
- Event ID 1: Process Create (command line logging)
Shorten session cookie TTL to 1 hour for sensitive applications
Block Chrome remote debugging via enterprise policy

Priority 2: Short-Term (Month 1-2)

Deploy DBSC for Google Workspace environments
Enable Credential Guard on all Windows 11 Enterprise endpoints
Enable HVCI enterprise-wide (verify driver compatibility first)
Implement application allowlisting or Smart App Control
Deploy dark web monitoring for corporate credential exposure (SpyCloud, Flare, SOCRadar)

Priority 3: Medium-Term (Quarter 1-2)

Accelerate passkey/FIDO2 adoption -- target 100% for privileged accounts by Q2 2026
Deploy ITDR (Identity Threat Detection and Response) across all identity stores
Implement Zero Trust architecture with microsegmentation
Deploy browser isolation for high-value user segments
Eliminate BYOD access to sensitive corporate resources or require managed browser

Priority 4: Ongoing

Continuous credential monitoring via dark web intelligence platforms
Regular purple team exercises specifically testing infostealer TTPs
Maintain detection rules -- update YARA/Sigma/KQL as new families emerge
Monitor for HVCI/CET bypass attempts -- attackers will try to disable

7. Post-Compromise: Detecting Stolen Credentials in Use

7.1 Indicators of Stolen Credential Use

Indicator	Detection Method
Impossible travel	Login from geographically impossible locations within timeframe
New device + known creds	DBSC failure (no TPM proof); device fingerprint mismatch
Anti-detect browser fingerprint	Canvas fingerprint anomalies, WebGL hash mismatches, timezone/language inconsistencies
Session cookie replay	Same session ID from different IP/device; cookie used without prior auth flow
Credential stuffing patterns	High-velocity auth attempts across multiple accounts from same IP range
Abnormal access patterns	Accessing resources the user never accessed before; bulk data download

7.2 SIEM Detection Rules for Stolen Credential Use

// Impossible travel detection
SigninLogs
| where ResultType == 0
| summarize by UserPrincipalName, IPAddress, Location, TimeGenerated
| join kind=inner (
    SigninLogs
    | where ResultType == 0
    | summarize by UserPrincipalName, IPAddress, Location, TimeGenerated
) on UserPrincipalName
| where TimeGenerated1 > TimeGenerated and datetime_diff('minute', TimeGenerated1, TimeGenerated) < 60
| where Location != Location1

// Session token reuse from new device
AADSignInEventsBeta
| where SessionId != ""
| summarize DeviceCount=dcount(DeviceName), IPs=make_set(IPAddress) by SessionId, AccountUpn
| where DeviceCount > 1

7.3 Dark Web Monitoring Integration

Deploy continuous monitoring for:

Corporate email addresses in stealer logs (Telegram channels, Genesis Market successors, Russian Market)
Session cookies for corporate domains
Corporate VPN credentials
SSO/SAML tokens
API keys and service account credentials

Response SLA when detected:

Privileged accounts: Immediate password reset + session revocation (< 1 hour)
Standard accounts: Reset within 4 hours
Service accounts: Rotate credentials within 24 hours
All: Review access logs for signs of unauthorized use during exposure window

8. The Modern Stealer Kill Chain and Where to Break It

[1] Delivery        --> Smart App Control, application allowlisting, email filtering
        |
[2] Execution       --> ASR rules, HVCI, CET, EDR behavioral detection
        |
[3] Credential      --> Credential Guard (OS creds), LSASS PPL, browser DB access
    Harvesting          monitoring, DPAPI monitoring
        |
[4] Session/Cookie  --> DBSC (device binding), short TTL, App-Bound Encryption
    Theft
        |
[5] Data Staging    --> File access monitoring, DLP, clipboard monitoring
        |
[6] Exfiltration    --> NDR, DNS monitoring, outbound traffic analysis
        |
[7] Credential Use  --> Impossible travel, DBSC validation failure, dark web monitoring,
    (by attacker)       Zero Trust continuous verification

Highest-impact intervention points:

Stage 1 (Delivery): Prevent execution entirely -- highest ROI
Stage 4 (Cookie Theft): DBSC makes stolen cookies worthless -- neutralizes the primary stealer objective
Stage 7 (Credential Use): Zero Trust + continuous monitoring catches what prevention missed

9. Summary: Defender's Prioritized Checklist

Must-Have (Non-Negotiable)

ASR rules in Block mode (especially LSASS protection)
LSASS PPL enabled
Credential Guard enabled (Windows 11 Enterprise)
HVCI enabled
Session cookie TTL reduced to 1 hour
Chrome remote debugging blocked via policy
Sysmon deployed with credential-theft config
Detection rules for browser DB access by non-browser processes

Should-Have (High Impact)

DBSC enabled for Google Workspace
Passkeys/FIDO2 for privileged accounts
Dark web credential monitoring
Application allowlisting or Smart App Control
Zero Trust with microsegmentation
ITDR across identity stores

Nice-to-Have (Defense in Depth)

Browser isolation for high-value users
BYOD elimination for sensitive access
Purple team exercises for stealer TTPs
AI-powered behavioral analytics (Vectra, CrowdStrike Charlotte AI)

26 KiB Raw Permalink Blame History