TWEAKOS — Windows Stealer, Telegram-Bot C2 & Stolen-Account Marketplace

Looks for: a file named SystemHelper.exe written into a user Startup folder path. Accomplishes: catches the packaged-build persistence variant at install time, before the first theft cycle runs.

Trace: H01 · IOA-1

// HUNT: SystemHelper.exe written into a user Startup folder (packaged-build persistence)
// HYPOTHESIS: H01
// USE: hunt
// MITRE: T1547.001
// CONF: high
// FP: medium
// COST: low
// TIMEFRAME: 30d
// REQUIRES: PeFileWritten with FileName, FilePath, ComputerName, UserName, SHA256HashData — ⚠ validate in tenant: some sensor versions expose the write-target directory as TargetDirectoryName instead of FilePath
// FALSE POSITIVES: any legitimate vendor utility that happens to share the generic name "SystemHelper.exe"
// TUNING: exclude hosts and hashes matching a known-vendor, Authenticode-signed "SystemHelper.exe" once your fleet baseline confirms one exists
// VALIDATION: STATIC-ONLY
#event_simpleName = PeFileWritten
| test(@timestamp >= now() - 2592000000)
| FileName = /^SystemHelper\.exe$/i
| FilePath = /\\Start Menu\\Programs\\Startup\\/i
| table([@timestamp, ComputerName, UserName, FileName, FilePath, SHA256HashData])
| sort(@timestamp, order=desc, limit=1000)

Looks for: a new HKCU ...\CurrentVersion\Run value literally named SystemHelper. Accomplishes: catches the script-build persistence variant, the other half of the no-admin persistence pair.

Trace: H02 · IOA-2

// HUNT: HKCU Run key value named SystemHelper (script-build persistence)
// HYPOTHESIS: H02
// USE: hunt
// MITRE: T1547.001
// CONF: high
// FP: medium
// COST: low
// TIMEFRAME: 30d
// REQUIRES: AsepValueUpdate or RegGenericValueUpdate with RegObjectName, RegValueName, RegStringValue, ComputerName, UserName
// FALSE POSITIVES: any legitimate helper application that happens to register a Run value literally named "SystemHelper"
// TUNING: confirm RegStringValue points at a known-bad or unexplained path before escalating; allowlist any confirmed legitimate vendor entry after fleet baseline review
// VALIDATION: STATIC-ONLY
#event_simpleName = /AsepValueUpdate|RegGenericValueUpdate/
| test(@timestamp >= now() - 2592000000)
| RegObjectName = /\\Software\\Microsoft\\Windows\\CurrentVersion\\Run$/i
| RegValueName = /^SystemHelper$/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue])
| sort(@timestamp, order=desc, limit=1000)

Looks for: any process execution of SystemHelper.exe, regardless of which persistence variant installed it. Accomplishes: a complementary execution-side check that also catches a manually-launched copy outside Startup/Run.

Trace: H03 · IOA-3

// HUNT: SystemHelper.exe process execution
// HYPOTHESIS: H03
// USE: hunt
// MITRE: T1547.001
// CONF: high
// FP: medium
// COST: low
// TIMEFRAME: 30d
// REQUIRES: ProcessRollup2 with FileName, ImageFileName, ParentBaseFileName, CommandLine, SHA256HashData
// FALSE POSITIVES: same generic-name collision risk as Q01
// TUNING: correlate with Q01/Q02 hits on the same host before escalating a standalone Q03 hit; allowlist a confirmed legitimate signed hash after baseline review
// VALIDATION: STATIC-ONLY
#event_simpleName = ProcessRollup2
| test(@timestamp >= now() - 2592000000)
| FileName = /^SystemHelper\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, SHA256HashData])
| sort(@timestamp, order=desc, limit=1000)

Looks for: a process running from a PyInstaller-style _MEI<digits> temp-extraction folder with no Authenticode signature. Accomplishes: a packaging-level fingerprint for the frozen Python stealer build. Caveat: the reporting we captured mentions sys.frozen-style packaging but never names PyInstaller specifically for TWEAKOS — this query is an analyst hypothesis based on common frozen-Python behavior, not a sourced TWEAKOS artifact, and it will also fire on any other PyInstaller-packaged software on the fleet.

Trace: H04

// HUNT: Unsigned process executing from a PyInstaller-style _MEI temp-extraction path
// HYPOTHESIS: H04
// USE: hunt (unconfirmed inference, not a sourced TWEAKOS artifact)
// MITRE: T1204.002
// CONF: low
// FP: high
// COST: medium
// TIMEFRAME: 14d
// REQUIRES: ProcessRollup2 with ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData, AuthenticodeHashData — ⚠ validate in tenant: AuthenticodeHashData population depends on sensor policy
// FALSE POSITIVES: every other PyInstaller-onefile application on the fleet (internal tools, some commercial software) will also match this path pattern
// TUNING: allowlist known-good PyInstaller-built internal tools by hash; require correlation with Q01/Q02/Q03/Q06/Q07 before treating a hit as TWEAKOS-related
// VALIDATION: STATIC-ONLY
#event_simpleName = ProcessRollup2
| test(@timestamp >= now() - 1209600000)
| ImageFileName = /\\AppData\\Local\\Temp\\_MEI[0-9]{5,8}\\/i
| AuthenticodeHashData = ""
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, SHA256HashData])
| sort(@timestamp, order=desc, limit=1000)

Looks for: wscript.exe or cscript.exe launched against a command line matching the blocker_<id>.vbs naming pattern. Accomplishes: catches the coercion stage while the file still exists on disk; the backend deletes it after use, so alerting speed matters more than lookback depth here.

Trace: H05 · IOA-4

// HUNT: wscript.exe/cscript.exe executing a blocker_<id>.vbs coercion script
// HYPOTHESIS: H05
// USE: hunt
// MITRE: T1491.001
// CONF: high
// FP: low
// COST: low
// TIMEFRAME: 30d
// REQUIRES: ProcessRollup2 with FileName, ParentBaseFileName, CommandLine
// FALSE POSITIVES: an internal script coincidentally named with the same blocker_<id>.vbs pattern (unlikely, but confirm before treating as fatal)
// TUNING: exclude any documented internal script inventory that happens to match the naming pattern
// VALIDATION: STATIC-ONLY
#event_simpleName = ProcessRollup2
| test(@timestamp >= now() - 2592000000)
| FileName = /^(wscript|cscript)\.exe$/i
| CommandLine = /blocker_[A-Za-z0-9_-]+\.vbs/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=1000)

Looks for: a DNS resolution of discord.com attributed to a process that is not a known Discord/browser client. Accomplishes: surfaces the token-validation step for correlation with an existing Q01–Q05 hit. This is NOT a malicious-infrastructure query — Discord's API is legitimate and this signal is meaningless in isolation.

Trace: H06

// HUNT: Non-Discord-client process resolving discord.com (Discord token-validation correlation)
// HYPOTHESIS: H06
// USE: enrichment only — NEVER a standalone alert, NEVER a block candidate
// MITRE: T1528
// CONF: low
// FP: high
// COST: medium
// TIMEFRAME: 7d
// REQUIRES: DnsRequest with DomainName, ContextProcessId_decimal; ProcessRollup2 with TargetProcessId_decimal, FileName, ImageFileName, CommandLine
// FALSE POSITIVES: extremely high — discord.com is legitimate, widely-used infrastructure; any non-Discord app that embeds Discord's API (bots, integrations, browser extensions) will also match
// TUNING: only ever run this joined against a host that already has a Q01/Q02/Q03/Q04 hit; never alert on this query alone; expand the client-exclusion list for your environment's known Discord-adjacent tooling before relying on it
// VALIDATION: STATIC-ONLY
#event_simpleName = DnsRequest
| test(@timestamp >= now() - 604800000)
| DomainName = /(^|\.)discord\.com$/i
| rename(field=ContextProcessId_decimal, as=TargetProcessId_decimal)
| join(query={#event_simpleName = ProcessRollup2 | FileName != /^(discord|discordptb|discordcanary|chrome|msedge|firefox|brave)\.exe$/i}, field=TargetProcessId_decimal)
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, DomainName])
| sort(@timestamp, order=desc, limit=1000)

Looks for: a DNS resolution of api.telegram.org attributed to a process that is not a known Telegram/browser client. Accomplishes: surfaces the exfiltration channel (sendMessage/sendDocument) for correlation with an existing Q01–Q05 hit. This is NOT a malicious-infrastructure query — the Telegram Bot API is legitimate shared infrastructure serving an enormous number of unrelated bots.

Trace: H07

// HUNT: Non-Telegram-client process resolving api.telegram.org (Bot API exfiltration correlation)
// HYPOTHESIS: H07
// USE: enrichment only — NEVER a standalone alert, NEVER a block candidate
// MITRE: T1041
// CONF: low
// FP: high
// COST: medium
// TIMEFRAME: 7d
// REQUIRES: DnsRequest with DomainName, ContextProcessId_decimal; ProcessRollup2 with TargetProcessId_decimal, FileName, ImageFileName, CommandLine
// FALSE POSITIVES: extremely high — api.telegram.org is legitimate infrastructure used by an enormous number of unrelated Telegram bots and integrations
// TUNING: only ever run this joined against a host that already has a Q01/Q02/Q03/Q05 hit; never alert on this query alone; expand the client-exclusion list for your environment's known Telegram-adjacent tooling before relying on it
// VALIDATION: STATIC-ONLY
#event_simpleName = DnsRequest
| test(@timestamp >= now() - 604800000)
| DomainName = /(^|\.)api\.telegram\.org$/i
| rename(field=ContextProcessId_decimal, as=TargetProcessId_decimal)
| join(query={#event_simpleName = ProcessRollup2 | FileName != /^(telegram|updater|chrome|msedge|firefox|brave)\.exe$/i}, field=TargetProcessId_decimal)
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, DomainName])
| sort(@timestamp, order=desc, limit=1000)