Analytics Story: RedLine Stealer

Updated Date: 2026-05-13 ID: 12e31e8b-671b-4d6e-b362-a682812a71eb Author: Teoderick Contreras, Splunk Product: Splunk Enterprise Security

Description

Leverage searches that allow you to detect and investigate unusual activities that might relate to the Redline Stealer trojan, including looking for file writes associated with its payload, screencapture, registry modification, persistence and data collection..

Why it matters

RedLine Stealer is a malware available on underground forum and subscription basis that are compiled or written in C#. This malware is capable of harvesting sensitive information from browsers such as saved credentials, auto file data, browser cookies and credit card information. It also gathers system information of the targeted or compromised host like username, location IP, RAM size available, hardware configuration and software installed. The current version of this malware contains features to steal wallet and crypto currency information.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Windows Query Registry UnInstall Program List	Query Registry	Anomaly
Windows Modify Registry UpdateServiceUrlAlternate	Modify Registry	Anomaly
Windows Modify Registry Auto Minor Updates	Modify Registry	Hunting
Executables Or Script Creation In Temp Path	Masquerading	Anomaly
Disabling Defender Services	Disable or Modify Tools	TTP
HTTP Malware User Agent	Web Protocols	TTP
Windows DisableAntiSpyware Registry	Disable or Modify Tools	TTP
Windows Modify Registry Auto Update Notif	Modify Registry	Anomaly
Non Firefox Process Access Firefox Profile Dir	Credentials from Web Browsers	Anomaly
Registry Keys Used For Persistence	Registry Run Keys / Startup Folder	TTP
Windows Modify Registry WuServer	Modify Registry	Hunting
Windows Modify Registry Disable WinDefender Notifications	Modify Registry	TTP
Windows Modify Registry USeWuServer	Modify Registry	Hunting
Windows Suspicious Process File Path	Match Legitimate Resource Name or Location, Create or Modify System Process	TTP
Windows Credentials from Password Stores Chrome Login Data Access	Query Registry	Anomaly
Windows Query Registry Browser List Application	Query Registry	Anomaly
Windows Scheduled Task with Highest Privileges	Scheduled Task	TTP
CMD Carry Out String Command Parameter	Windows Command Shell	Hunting
Windows Credentials from Password Stores Chrome LocalState Access	Query Registry	Anomaly
Windows Modify Registry No Auto Update	Modify Registry	Anomaly
Schtasks scheduling job on remote system	Scheduled Task	TTP
Disable Windows Behavior Monitoring	Disable or Modify Tools	TTP
Windows Modify Registry No Auto Reboot With Logon User	Modify Registry	Anomaly
Windows Service Stop Win Updates	Service Stop	Anomaly
Executables Or Script Creation In Suspicious Path	Masquerading	Anomaly
Windows Modify Registry Do Not Connect To Win Update	Modify Registry	Anomaly
Non Chrome Process Accessing Chrome Default Dir	Credentials from Web Browsers	Anomaly
Windows Modify Registry Tamper Protection	Modify Registry	TTP
Scheduled Task Deleted Or Created via CMD	Scheduled Task	Anomaly
Suspicious Process DNS Query Known Abuse Web Services	Visual Basic	TTP
Windows Boot or Logon Autostart Execution In Startup Folder	Registry Run Keys / Startup Folder	Anomaly
Windows Credentials from Password Stores Chrome Extension Access	Query Registry	Anomaly
Windows Modify Registry wuStatusServer	Modify Registry	Hunting
Windows Event For Service Disabled	Disable or Modify Tools	Hunting

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Windows Event Log Security 4663	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 13	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Suricata	Other	`suricata`	`not_applicable`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log System 7040	Windows	`XmlWinEventLog`	`XmlWinEventLog:System`
Sysmon EventID 22	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`

References

Source: GitHub | Version: 2