Infostealer

Harvests browser credentials, cookies, wallets and session tokens for resale

categoryMalwareseverityHighdetectability (measured in our lab)Mediumlabdetected in lab

Example: Lumma, Vidar, RedLine, AMOS

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1555.003 · Stage Popular Credential Files for Exfiltration · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1555.003 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1555.003 -TestGuids f543635c-1705-42c3-b180-efd6dc6e7ee7 -TimeoutSeconds 120'

ATT&CK T1555.003 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1555.003 -Tool atomic -RunId run-2026-10-14-026 -Command 'Invoke-AtomicTest T1555.003 -TestGuids f543635c-1705-42c3-b180-efd6dc6e7ee7 -TimeoutSeconds 120'

ATT&CK T1555.003 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1555.003 -Tool atomic -RunId run-2026-10-16-004 -Command 'Invoke-AtomicTest T1555.003 -TestGuids f543635c-1705-42c3-b180-efd6dc6e7ee7 -TimeoutSeconds 120'

+ 3 more test variant(s) in the corpus.

What our lab measured

detected windows · 2026-10-27 · detected in 73s

What it looked like in telemetry

Log source	What it means
Event · EID 1014	Name resolution for the name wpad timed out
Sysmon · EID 11	Credential-store theft: non-browser process staged a copy of a browser cookie / login-data / password store (incl. renamed copies, Firefox key4.db/logins.json)
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
PowerShell · EID 4104	Powershell script used "Invoke-command" cmdlet to execute sub script
Security · EID 4624	Non network or service local logon.
… and 4 more event type(s)

Detection that fired

✓ Wazuh 100200 (level 10) lab rule — Credential-store theft: non-browser process staged a copy of a browser cookie / login-data / password store (incl. renamed copies, Firefox key4.db/logins.json)

Plus 13 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~68974 incidental alerts/hour — tune against this.

partially detected windows · 2026-10-19 · detected in 0s

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Access token manipulation: SYSTEM-integrity process created by a non-service parent
Sysmon · EID 11	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe created a new scripting file under Windows Temp or User data folder
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
Event · EID 16384	Software protection service scheduled successfully.
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
PowerShell · EID 4104	Powershell script used "Invoke-command" cmdlet to execute sub script
… and 6 more event type(s)

Detection that fired

✓ Wazuh 100230 (level 10) lab rule — Access token manipulation: SYSTEM-integrity process created by a non-service parent

Plus 20 stock Wazuh/Sysmon rule(s) in the window.

⚠ Gap: rule 100200 was expected but did not fire in this run — the telemetry above is the hunt surface, not a solved detection.

Background noise in the window: ~84900 incidental alerts/hour — tune against this.

Classification

26 values: 14 reviewed, 2 lab-measured, 8 imported, 2 derived. What do these mean?

Exploitability

Attack vector	Credential attacksMalware
Reach (CVSS)	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Attacker skill required	Low
Resources required	Low
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Severity	High
Impact	Confidentiality
Platform	LinuxmacOSWindows
Environment	MobileOn-premises
Target asset class	EndpointIdentity
Kill-chain phase (tactic)	Credential Access

Detection & telemetry

Detectability (measured in our lab)	Medium
Detectability (public detection content)	High
Noise level	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	File AccessProcess AccessProcess Creation

Detection & response

Mitigated by 20

M1017 attack-mitigation
M1018 attack-mitigation
M1021 attack-mitigation
M1027 attack-mitigation
M1051 attack-mitigation
D3-CF d3fend
D3-CM d3fend
D3-CQ d3fend
D3-DF d3fend
D3-DI d3fend
D3-FA d3fend
D3-FE d3fend
D3-FEV d3fend
D3-FIM d3fend
D3-LFP d3fend
D3-RD d3fend
D3-RF d3fend
D3-RFAM d3fend
D3-SCA d3fend
D3-SCF d3fend

Detected by 10

DET0037 attack-detection-strategy
24c77512-782b-448a-8950-eddb0785fc71 sigma
47147b5b-9e17-4d76-b8d2-7bac24c5ce1b sigma
4b60e527-ec73-4b47-8cb3-f02ad927ca65 sigma
851fd622-b675-4d26-b803-14bc7baa517a sigma
a1dfd976-4852-41d4-9507-dc6590a3ccd0 sigma
d0dae994-26c6-4d2d-83b5-b3c8b79ae513 sigma
d557dc06-62e8-4468-a8e8-7984124908ce sigma
fc028194-969d-4122-8abe-0470d5b8f12f sigma
100200 wazuh

Tested by 18

124e13e5-d8a1-4378-a6ee-a53cd0c7e369 atomic
28498c17-57e4-495a-b0be-cc1e36de408b atomic
29d0c390-3cbc-4e4e-a52b-a1350ed836b7 atomic
3d111226-d09a-4911-8715-fe11664f960d atomic
6f2c5c87-a4d5-4898-9bd1-47a55ecaf1dd atomic
70422253-8198-4019-b617-6be401b49fce atomic
764ea176-fb71-494c-90ea-72e9d85dce76 atomic
87e88698-621b-4c45-8a89-4eaebdeaabb1 atomic
8c05b133-d438-47ca-a630-19cc464c4622 atomic
9a2915b3-3954-4cce-8c76-00fbf4dbd014 atomic
a6a5ec26-a2d1-4109-9d35-58b867689329 atomic
c1402f7b-67ca-43a8-b5f3-3143abedc01b atomic
dc9cd677-c70f-4df5-bd1c-f114af3c2381 atomic
e359627f-2d90-4320-ba5e-b0f878155bbe atomic
e5e3d639-6ea8-4408-9ecd-d5a286268ca0 atomic
eb8da98a-2e16-4551-b3dd-83de49baa14c atomic
ec1d0b37-f659-4186-869f-31a554891611 atomic
f543635c-1705-42c3-b180-efd6dc6e7ee7 atomic

Attack relationships

Parent: DPAPI secret theft
Parent: Malware-as-a-service (infostealers)

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

Run	Outcome	Tool	Platform	Ran at
`run-2026-10-14-026`	partially-detected	atomic	windows	2026-10-14
`run-2026-10-16-008`	detected	atomic	windows	2026-10-16
`run-2026-10-17-003`	detected	atomic	windows	2026-10-17
`run-2026-10-19-001`	partially-detected	atomic	windows	2026-10-19
`run-2026-10-27-026`	detected	atomic	windows	2026-10-27

run-2026-10-14-026 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=18). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1555.003 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=13 max_level=15 dwell_s=90
run-2026-10-16-008 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=18). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1555.003 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=5 incidental=15 max_level=15 dwell_s=90
run-2026-10-17-003 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=18). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1555.003 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=5 incidental=1492 max_level=15 dwell_s=90
run-2026-10-19-001 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=18). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1555.003 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=2264 max_level=15 dwell_s=90
run-2026-10-27-026 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=18). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1555.003 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=5 incidental=1801 max_level=15 dwell_s=90

Framework references

Primary source: https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/
attack: T1555.003 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Malware' table, line 89 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 89 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0003 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-026 (partially-detected) for T1555.003: no alert matched the expected technique
ev-0004 (Phase 4 detection lab - detonation runs 2026-10-16) — Lab detonation run-2026-10-16-008 (detected): Wazuh rule(s) 100200 fired on T1555.003 within the detonation window
Credential-store theft: non-browser process staged a copy of a browser cookie / login-data / password store (incl. renamed copies, Firefox key4.db/logins.json)
ev-0005 (Phase 4 detection lab - detonation runs 2026-10-17) — Lab detonation run-2026-10-17-003 (detected): Wazuh rule(s) 100200 fired on T1555.003 within the detonation window
Credential-store theft: non-browser process staged a copy of a browser cookie / login-data / password store (incl. renamed copies, Firefox key4.db/logins.json)
ev-0006 (Phase 4 detection lab - detonation runs 2026-10-19) — Lab detonation run-2026-10-19-001 (partially-detected) for T1555.003: no alert matched the expected technique
ev-0007 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-026 (detected): Wazuh rule(s) 100200 fired on T1555.003 within the detonation window
Credential-store theft: non-browser process staged a copy of a browser cookie / login-data / password store (incl. renamed copies, Firefox key4.db/logins.json)