Amber Albatross — PUP-Bundled → PyInstaller Stealer

Looks for: a process extracting/running from a PyInstaller _MEI temp directory in a user path. Accomplishes: catches the unpacked stealer. FP: some legit PyInstaller apps — flag user/temp paths + a non-vendor parent.

// HUNT: Amber Albatross PyInstaller stealer (_MEI extraction from a user path)
// MITRE: T1059.006, T1027.002 | CONF: high  FP: low-med  COST: low
// FP NOTES: some legit PyInstaller apps; flag %TEMP%/%AppData% + installer/shell parent
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (ImageFileName=/\\(Temp|AppData\\Local\\Temp)\\_MEI[0-9]+\\/i or CommandLine=/_MEI[0-9]+/i)
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData], limit=200)

Looks for: an InnoSetup installer (or *tmp\is-* path) spawning a child binary from a temp path. Accomplishes: the installer stage. FP: legit InnoSetup apps — correlate with a following Q1/Q3.

// HUNT: Amber Albatross InnoSetup installer chain
// MITRE: T1204.002 | CONF: medium  FP: medium  COST: low
// TUNING: InnoSetup is legit; correlate to a following Q1 (_MEI) or Q3 (recon)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (ParentBaseFileName=/setup.*\.exe$|.*installer.*\.exe$/i or ParentImageFileName=/\\Temp\\is-[A-Za-z0-9]+/i)
| FileName=/\.exe$/i
| ImageFileName=/\\(Temp|AppData)\\/i
| table([@timestamp, ComputerName, UserName, ParentImageFileName, ImageFileName, CommandLine], limit=200)

Looks for: a burst of discovery commands parented by a binary in a user/temp path. Accomplishes: the stealer recon stage. FP: admin scripts — scope to user-path parents + breadth.

// HUNT: Amber Albatross stealer recon burst
// MITRE: T1087, T1082, T1016 | CONF: med-high  FP: medium  COST: low
// TUNING: scope to a user/temp-path parent; require breadth (>=4 distinct recon binaries)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentImageFileName=/\\(Temp|AppData|Users\\[^\\]+\\Downloads)\\/i
| FileName=/^(whoami|systeminfo|ipconfig|tasklist|net|net1|nltest|wmic|reg|hostname)\.exe$/i
| groupBy([aid, ComputerName, ParentImageFileName], function=[count(field=FileName, distinct=true, as=cmds), collect([FileName, CommandLine], limit=20)])
| cmds>=4
| sort(cmds, order=desc)

Looks for: cmd/powershell launching an executable from a user/temp path (the obfuscated-chain → stealer handoff). FP: legit tooling — correlate with Q1/Q3.

// HUNT: Amber Albatross shell -> user-path packed exe handoff
// MITRE: T1059.001/.003 | CONF: medium  FP: medium  COST: low
// TUNING: correlate to Q1 (_MEI) / Q3 (recon); exclude sanctioned installers
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(cmd|powershell|pwsh)\.exe$/i
| ImageFileName=/\\(Temp|AppData\\Local\\Temp|Users\\[^\\]+\\AppData)\\.+\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine], limit=200)

Looks for: writes into a _MEI* temp directory (PyInstaller self-extraction). Accomplishes: catches the unpack at file-write time. FP: legit PyInstaller apps — pair with Q2 (installer) or Q3 (recon).

// HUNT: PyInstaller _MEI self-extraction
// MITRE: T1027.002 | CONF: high  FP: low-med  COST: low
// TUNING: pair with Q2/Q3; legit PyInstaller apps also extract to _MEI
#event_simpleName=/PeFileWritten|NewExecutableWritten/
| TargetFileName=/\\(Temp|AppData\\Local\\Temp)\\_MEI[0-9]+\\/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName], limit=200)

Looks for: outbound connections from a binary in a user/temp path (the stealer beacon/exfil). FP: some apps run from there — correlate with Q1/Q3.

// HUNT: Amber Albatross stealer C2 / exfil from a user-path exe
// MITRE: T1071.001, T1041 | CONF: medium  FP: medium  COST: med
// TUNING: correlate to Q1/Q3; exclude sanctioned apps that run from AppData
#event_simpleName=NetworkConnectIP4
| ContextImageFileName=/\\(Temp|AppData\\Local\\Temp|Users\\[^\\]+\\AppData)\\.+\.exe$/i
| RemoteAddressIP4!=/^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.|127\.)/
| table([@timestamp, ComputerName, ContextImageFileName, RemoteAddressIP4, RemotePort], limit=200)