Vidar Stealer + XMRig Malvertising — Hunt & Hardening Pack

Looks for: the campaign's persistence value SystemAgentService, the schtasks … onlogon registration, or any NisSrv.exe running outside System32 (the real Defender NIS lives in Program Files). Accomplishes: the single highest-fidelity signal. FP: low — this exact name+path combination is unique to the campaign.

// HUNT: Vidar/XMRig SystemAgentService persistence (T1053.005 / T1547.001 / T1036.005)
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2 + Reg events
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|RegGenericValueUpdate|AsepValueUpdate/
| (CommandLine=/schtasks(\.exe)?\s.{0,120}SystemAgentService|SystemAgentService.{0,80}NisSrv/i
   or RegValueName=/^SystemAgentService$/i
   or RegStringValue=/\\Microsoft\\Windows\\Temp\\NisSrv\.exe/i
   or ImageFileName=/\\Users\\[^\\]+\\.{0,60}\\NisSrv\.exe$/i)
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, RegValueName, RegStringValue, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: a process named MicrosoftUpdate.exe running or written under a user Temp path — Vidar's masquerade drop. Accomplishes: catches the stealer stage. FP: low — legitimate Windows update binaries do not run from \Users\…\Temp\.

// HUNT: Vidar stealer drop MicrosoftUpdate.exe (T1036.005 / T1555)
// CONF: high  FP: low  COST: low
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|PeFileWritten/
| (ImageFileName=/\\Users\\[^\\]+\\.{0,40}\\Temp\\MicrosoftUpdate\.exe$/i
   or TargetFileName=/\\Users\\[^\\]+\\.{0,40}\\Temp\\MicrosoftUpdate\.exe$/i)
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, TargetFileName, SHA256HashData, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: a fake MpClient.dll written to or loaded from a user/temp path (the real one lives under Program Files\Windows Defender). Accomplishes: catches the search-order-hijack execution stage. FP: medium — scope to non-standard paths; a MpClient.dll outside the Defender directory is the signal.

// HUNT: Vidar loader MpClient.dll sideload (T1574.002 / T1562.001)
// CONF: high  FP: medium  COST: low
// TUNING: exclude \Program Files\Windows Defender\ and \Program Files\Microsoft Defender\ paths
#event_simpleName=/PeFileWritten|ProcessRollup2|SyntheticProcessRollup2/
| (TargetFileName=/\\Users\\[^\\]+\\.{0,80}\\MpClient\.dll$/i
   or TargetFileName=/\\Windows\\Temp\\MpClient\.dll$/i
   or ImageFileName=/\\Users\\[^\\]+\\.{0,80}\\MpClient\.dll$/i)
| table([@timestamp, aid, ComputerName, UserName, TargetFileName, ImageFileName, SHA256HashData], limit=200)
| sort(@timestamp, order=desc)

Looks for: the XMRig component set under \Microsoft\Windows\Temp\ or the tell-tale --config=mgwthmc2.dat launch, plus the abusable WinRing0x64.sys/libuv-1.dll in a temp path. Accomplishes: catches the miner stage. FP: low for the specific config/path; the fake MicrosoftEdgeUpdate.exe location is the discriminator (legit EdgeUpdate lives in Program Files).

// HUNT: Vidar-campaign XMRig miner drop/launch (T1496 / T1036.005)
// CONF: high  FP: low  COST: low
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|PeFileWritten/
| (CommandLine=/--config=\s*mgwthmc2\.dat|MicrosoftEdgeUpdate\.exe.{0,40}mgwthmc2/i
   or TargetFileName=/\\Microsoft\\Windows\\Temp\\(MicrosoftEdgeUpdate\.exe|libuv-1\.dll|WinRing0x64\.sys|mgwthmc2\.dat)$/i
   or ImageFileName=/\\Microsoft\\Windows\\Temp\\MicrosoftEdgeUpdate\.exe$/i)
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, TargetFileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: execution of any of the published Factory-v3 loader SHA-256s. Accomplishes: a fast, decisive historical sweep. FP: none — exact-hash match. Note the loader is polymorphic, so a clean result does not clear the host — pair with Q1/Q3/Q4. Full hash list in §9.

// HUNT: Vidar Factory-v3 loader by known hash (T1204.002 / T1027.001)
// CONF: high  FP: low  COST: low | polymorphic loader — behavioral queries carry coverage
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|PeFileWritten/
| SHA256HashData=/^(097a87cfa4a5186aba3bba096866692951bde59c6f0c2e8c1c4a599246d14da8|201594c9d173bba6cb509407ecba378c19b93da0a81a2182a913c480e6dbb54e|35dde1b2482b12582820a861e7c46f10721af6b75052fc872c05d2230a4e8ca1|0a6a67a2fc4d79ec1cd8afc5b8b7a5e69a406e53d57a7334e097c5d0644de5f6|488d941b7b4428b0f4a0e5495e3857b9b96215fb3e7f164b06640d59096425e6)$/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, SHA256HashData], limit=max)
| sort(@timestamp, order=desc)

Looks for: outbound to the four Vidar C2 IPs on :443, DNS for pool.supportxmr.com (XMRig), or the ip-api.com geo-beacon. Accomplishes: network-side confirmation. FP: C2 IPs and mining pool are strong; ip-api.com is dual-use (some legit apps query it) — treat that branch as pivot, alert on the pool + C2 IPs.

// HUNT: Vidar C2 + XMRig pool + geo-beacon (T1041 / T1071 / T1496)
// CONF: high  FP: medium  COST: low
// TUNING: alert on the C2 IPs + pool.supportxmr.com; keep the ip-api.com branch pivot-only (dual-use)
#event_simpleName=/NetworkConnectIP4|DnsRequest/
| (RemoteAddressIP4=/^(136\.243\.203\.109|136\.243\.203\.111|116\.203\.243\.208|138\.199\.246\.13)$/
   or DomainName=/^(pool\.supportxmr\.com|ip-api\.com)$/i)
| table([@timestamp, aid, ComputerName, UserName, RemoteAddressIP4, RemotePort, DomainName], limit=200)
| sort(@timestamp, order=desc)