LummaC2 / Lumma Stealer — Malware-as-a-Service Infostealer

Looks for: mshta/PowerShell parented by a browser or Explorer, with iex+http in the command line. Accomplishes: catches the paste-and-run initial execution — the highest-fidelity ClickFix signal.

// HUNT: ClickFix paste-and-run (browser/Explorer -> mshta|powershell with iex+http)
// MITRE: T1204.004, T1059.001, T1218.005 | CONF: high  FP: low  COST: low
// FP NOTES: browsers/Explorer do not normally spawn mshta/powershell running iex+http
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(explorer|chrome|msedge|firefox|brave|opera|iexplore)\.exe$/i
| FileName=/^(mshta|powershell|pwsh|cmd)\.exe$/i
| CommandLine=/(iex|invoke-expression|mshta\s+http|DownloadString|DownloadData|FromBase64String|-enc(odedcommand)?\b).*?(http|\.store|\.shop|\.top)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Looks for: PowerShell command lines combining iex and an HTTP download. Accomplishes: the Red Canary loader analytic. FP: some admin/package tooling — exclude sanctioned package managers; pair with Q1 parent.

// HUNT: PowerShell invoke-expression + HTTP download (stealer loader)
// MITRE: T1059.001 | CONF: medium  FP: medium  COST: low
// TUNING: exclude legitimate package managers (choco/winget/scoop); pair with Q1 parent
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(powershell|pwsh)\.exe$/i
| CommandLine=/(iex|invoke-expression|\.invoke)/i
| CommandLine=/http/i
| CommandLine!=/(chocolatey|winget|scoop|PSGallery|Install-Module)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine], limit=200)

Looks for: OpenWith.exe / more.com spawned by mshta/powershell/a loader, or making network connections. Accomplishes: catches the in-memory stealer injection. FP: legit more.com in pipelines — flag anomalous parent / network.

// HUNT: Stealer hollowing into OpenWith.exe / more.com
// MITRE: T1055.012 | CONF: high  FP: low-med  COST: low
// TUNING: legit more.com runs in pipelines with conhost parent; flag mshta/powershell/loader parent
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(OpenWith\.exe|more\.com)$/i
| ParentBaseFileName=/^(mshta|powershell|pwsh|cmd|wscript|cscript|rundll32|regsvr32)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData], limit=200)

Looks for: a Chromium browser launched with --remote-debugging-port by a non-user/non-shortcut parent. Accomplishes: the cookie/credential ABE-bypass technique. FP: developers/automation use this — exclude sanctioned, flag unusual parents.

// HUNT: Chromium --remote-debugging-port cookie/credential theft (ABE bypass)
// MITRE: T1555.003, T1539 | CONF: med-high  FP: medium  COST: low
// TUNING: exclude dev/automation; flag launches parented by mshta/powershell/script hosts
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(chrome|msedge|brave|opera)\.exe$/i
| CommandLine=/--remote-debugging-port|--remote-debugging-pipe|--headless.*--user-data-dir/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine], limit=200)

Looks for: creation of System.txt in user temp/profile (the documented staging file). Accomplishes: surfaces collection-staging before exfil. FP: generic filename — correlate with Q1/Q3 on the same host.

// HUNT: Lumma System.txt credential staging
// MITRE: T1074.001 | CONF: medium  FP: medium  COST: low
// TUNING: generic name; correlate with Q1/Q3 hits on same aid/time
#event_simpleName=/NewExecutableWritten|FileWritten/
| TargetFileName=/\\(Temp|AppData)\\.*\\System\.txt$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName], limit=200)

Looks for: the TeslaBrowser/5.5 user agent in ingested proxy/HTTP telemetry. Accomplishes: high-fidelity C2 exfil signal. FP: none — the UA is unique to Lumma. Requires proxy/HTTP-header ingestion (not raw EDR netflow).

// HUNT: Lumma C2 exfil — TeslaBrowser/5.5 user agent
// MITRE: T1071.001, T1041 | CONF: high  FP: low  COST: med
// REQUIRES: proxy/SWG or HTTP-header telemetry ingested into NG-SIEM (field name varies)
HttpUserAgent=/TeslaBrowser\/5\.5/i
| table([@timestamp, ComputerName, aid, HttpUserAgent, DomainName, RemoteAddressIP4], limit=200)