Needle Stealer — Golang Modular Infostealer (Crypto / Browser Credential Theft)

Looks for: RegAsm.exe launched by a non-developer parent or from a user-writable path — the hollowing host. Accomplishes: catches Needle's injection target. RegAsm is a .NET SDK tool; outside dev/build it is almost always abuse.

// HUNT: RegAsm.exe abused as a process-hollowing target (Needle Stealer)
// MITRE: T1055.012 | CONF: high  FP: low  COST: low
// FALSE POSITIVES: legitimate .NET build/dev workflows (Visual Studio / MSBuild parents)
// TUNING: allow-list developer hosts; alert on RegAsm with loader/archive parents or temp paths
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^RegAsm\.exe$/i
| ParentBaseFileName!=/^(devenv|msbuild|cmd|powershell|explorer)\.exe$/i
| ImageFileName=/\\(Users\\[^\\]+\\(AppData|Downloads|Desktop)|ProgramData|Temp)\\/i OR CommandLine=""
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, ParentBaseFileName, CommandLine, SHA256HashData], limit=200)
| sort(@timestamp, order=desc)

Looks for: the writing or loading of iviewers.dll from a user directory — the DLL search-order hijack. Accomplishes: a near-unique signature of this chain. (PE-write variant; pair with Sysmon EID 7 for the load itself.)

// HUNT: iviewers.dll written/staged in a user-writable path (DLL search-order hijack)
// MITRE: T1574.001 | CONF: high  FP: low  COST: low
// REQUIRES: PeFileWritten / FileCreateInfo (load-time visibility via Sysmon EID 7 — see N2)
// FALSE POSITIVES: a legitimately signed iviewers.dll in its real install dir (excluded by path)
#event_simpleName=/PeFileWritten|NewExecutableWritten/
| TargetFileName=/\\iviewers\.dll$/i
| TargetFileName=/\\(Users\\[^\\]+\\(AppData|Downloads|Desktop)|ProgramData|Temp)\\/i
| table([@timestamp, ComputerName, ContextBaseFileName, TargetFileName, SHA256HashData], limit=200)
| sort(@timestamp, order=desc)

Looks for: extension/manifest files dropped under the browser extensions directory by something other than the browser itself. FP: legitimate extension installers / browser updaters — allow-list those writers.

// HUNT: Browser extension files written by a non-browser process (Needle rogue extension)
// MITRE: T1176, T1555.003 | CONF: medium  FP: medium  COST: low
// REQUIRES: FileCreateInfo with writing-process context
// FALSE POSITIVES: browser self-updates, sanctioned extension installers
// TUNING: allow-list chrome/msedge/firefox + your extension-management tooling as writers
#event_simpleName=/PeFileWritten/
| TargetFileName=/\\(Packages\\Extensions|User Data\\[^\\]+\\Extensions)\\/i
| TargetFileName=/\\(manifest\.json|background\.js|content\.js|service_worker\.js)$/i
| ContextBaseFileName!=/^(chrome|msedge|firefox|brave|opera|chrome_installer|MicrosoftEdgeUpdate)\.exe$/i
| table([@timestamp, ComputerName, ContextBaseFileName, TargetFileName], limit=200)
| sort(@timestamp, order=desc)

Looks for: external network connections made by RegAsm.exe (or another .NET utility) — these should never beacon out. Accomplishes: catches the exfil channel of the hollowed stealer.

// HUNT: Outbound C2 from RegAsm.exe / .NET utility (Needle exfil over HTTP)
// MITRE: T1071.001, T1041 | CONF: high  FP: low-med  COST: low
// REQUIRES: NetworkConnectIP4 with process context
// FALSE POSITIVES: rare; some EDR/telemetry agents proxy through .NET hosts — allow-list those
#event_simpleName=/NetworkConnectIP4/
| ContextBaseFileName=/^(RegAsm|RegSvcs|InstallUtil|MSBuild)\.exe$/i
| RemoteAddressIP4!=/^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)/
| table([@timestamp, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], limit=200)
| sort(@timestamp, order=desc)

Looks for: executables run straight from Downloads/Temp/archive paths with trading-/AI-app lures, or rundll32 launching a sideloaded DLL. FP: legitimate fresh downloads — correlate with Q1/Q2 on the same host.

// HUNT: Execution from a fake AI-trading app / archive in a user-writable path (Needle delivery)
// MITRE: T1204 | CONF: medium  FP: medium  COST: low
// FALSE POSITIVES: benign fresh downloads / portable apps — correlate with Q1/Q2
// TUNING: tighten the lure regex to your telemetry; prioritize hosts also hitting Q1/Q2
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ImageFileName=/\\(Users\\[^\\]+\\(Downloads|AppData\\Local\\Temp)|ProgramData)\\/i
| (FileName=/(trading|tradingclaw|ai[-_]?trade|crypto[-_]?bot|invest)/i
   OR (FileName=/^rundll32\.exe$/i AND CommandLine=/\\(Users|ProgramData|Temp)\\.+\.dll/i))
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData], limit=200)
| sort(@timestamp, order=desc)

Looks for: resolution of the known delivery / redirect domains. Investigate-only, perishable — refresh from current intel and pair with the behavioral hunts.

// HUNT: DNS resolution of known Needle Stealer delivery / redirect infrastructure
// MITRE: T1071.001 | CONF: high  FP: low  COST: low
// FALSE POSITIVES: researchers / sandboxes intentionally resolving the domains
#event_simpleName=DnsRequest
| DomainName=/(^|\.)tradingclaw\.pro$|(^|\.)studypages\.com$/i
| table([@timestamp, ComputerName, ContextBaseFileName, DomainName], limit=200)
| sort(@timestamp, order=desc)