From a7eb55b0cae3cae7e917f913d6632f463540de08 Mon Sep 17 00:00:00 2001 From: Teoderick Contreras Date: Tue, 6 Oct 2026 13:46:25 +0200 Subject: [PATCH 01/12] braodo_2026 --- .../download_files_using_telegram.yml | 5 +- ..._or_script_creation_in_suspicious_path.yml | 5 +- ...tables_or_script_creation_in_temp_path.yml | 5 +- ...fox_process_access_firefox_profile_dir.yml | 5 +- ...powershell_download_script_from_github.yml | 60 +++++++++++++++++++ ..._autostart_execution_in_startup_folder.yml | 5 +- ...indows_disable_or_stop_browser_process.yml | 4 +- .../windows_dns_query_request_to_tinyurl.yml | 7 ++- .../windows_password_managers_discovery.yml | 5 +- ...thon_process_accessing_facebook_domain.yml | 60 +++++++++++++++++++ ..._dns_query_request_by_telegram_bot_api.yml | 5 +- 11 files changed, 149 insertions(+), 17 deletions(-) create mode 100644 detections/endpoint/powershell_download_script_from_github.yml create mode 100644 detections/endpoint/windows_python_process_accessing_facebook_domain.yml diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml index 3403eef36a9..59268a324d4 100644 --- a/detections/endpoint/download_files_using_telegram.yml +++ b/detections/endpoint/download_files_using_telegram.yml @@ -1,8 +1,8 @@ name: Download Files Using Telegram id: 58194e28-ae5e-11eb-8912-acde48001122 -version: 12 +version: 13 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: TTP @@ -47,6 +47,7 @@ analytic_story: - XMRig - Water Gamayun - 0bj3ctivity Stealer + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1105 diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 88b6fb4b745..7bdf1594871 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,8 +1,8 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 -version: 31 +version: 32 creation_date: '2021-05-07' -modification_date: '2026-08-14' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -141,6 +141,7 @@ analytic_story: - Phantom Stealer - Starland RAT Campaign - Vidar Stealer + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/executables_or_script_creation_in_temp_path.yml b/detections/endpoint/executables_or_script_creation_in_temp_path.yml index 69962abd69f..70c7ca2f5d8 100644 --- a/detections/endpoint/executables_or_script_creation_in_temp_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_temp_path.yml @@ -1,8 +1,8 @@ name: Executables Or Script Creation In Temp Path id: e0422b71-2c05-4f32-8754-01fb415f49c9 -version: 27 +version: 28 creation_date: '2021-05-07' -modification_date: '2026-08-14' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -134,6 +134,7 @@ analytic_story: - Salat Stealer - Phantom Stealer - Vidar Stealer + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index 87b1884b1ca..c358aafab67 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -1,8 +1,8 @@ name: Non Firefox Process Access Firefox Profile Dir id: e6fc13b0-1609-11ec-b533-acde48001122 -version: 21 +version: 22 creation_date: '2021-09-15' -modification_date: '2026-08-14' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -54,6 +54,7 @@ analytic_story: - Salat Stealer - Phantom Stealer - Vidar Stealer + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1555.003 diff --git a/detections/endpoint/powershell_download_script_from_github.yml b/detections/endpoint/powershell_download_script_from_github.yml new file mode 100644 index 00000000000..a917ff1c28d --- /dev/null +++ b/detections/endpoint/powershell_download_script_from_github.yml @@ -0,0 +1,60 @@ +name: PowerShell Download Script From Github +id: 3ffbd4d4-84a7-453e-9e06-8e9cd0350366 +version: 1 +creation_date: '2026-10-06' +modification_date: '2026-10-06' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: This analytic detects PowerShell script block activity where download cmdlets such as DownloadFile, DownloadData, DownloadString, Invoke-WebRequest, Invoke-RestMethod, or Start-BitsTransfer are used to fetch script files (.bat, .js, .vbs) directly from raw GitHub content URLs. It leverages PowerShell Script Block Logging (Event ID 4104) to capture the full script text at execution time. Adversaries, including those deploying the Braodo Stealer, abuse raw GitHub URLs as a living-off-the-land staging mechanism to host and retrieve second-stage payloads, bypassing traditional download-site blocklists. If confirmed malicious, this activity indicates an active download-and-execute chain that could lead to credential theft, persistence, or further malware deployment on the affected endpoint. +data_source: + - Powershell Script Block Logging 4104 +search: |- + `powershell` EventCode=4104 ScriptBlockText IN ("*.DownloadFile(*", "*.DownloadData(*", "*.DownloadString(*", "*Invoke-WebRequest*", "*Invoke-RestMethod*", "*Start-BitsTransfer*") + | where match( + ScriptBlockText, + "(?i)https?://github\.com/[^/\s]+/[^/\s]+/raw/(main|master)/[^\s'\"]+(.bat|.js|.vbs)" + ) + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime + by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_download_script_from_github_filter` +how_to_implement: o successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba. +known_false_positives: Note that false positives may occur due to the use of the Download cmdlet by legitimate users, such as system administrators. It is recommended to apply appropriate filters as needed to minimize the number of false positives. +references: + - https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: PowerShell was identified running a Download Cmdlet to download Script on $dest$ by $user$ +analytic_story: + - Braodo Stealer +asset_type: Endpoint +mitre_attack_id: + - T1059.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_github/powershell_githu_download.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml index 48b60501976..6fa6786fe88 100644 --- a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml +++ b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml @@ -1,8 +1,8 @@ name: Windows Boot or Logon Autostart Execution In Startup Folder id: 99d157cb-923f-4a00-aee9-1f385412146f -version: 17 +version: 18 creation_date: '2023-01-16' -modification_date: '2026-07-20' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -51,6 +51,7 @@ analytic_story: - BlankGrabber Stealer - Phantom Stealer - Starland RAT Campaign + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1547.001 diff --git a/detections/endpoint/windows_disable_or_stop_browser_process.yml b/detections/endpoint/windows_disable_or_stop_browser_process.yml index 354d3e7a7d7..24eb9e8c80e 100644 --- a/detections/endpoint/windows_disable_or_stop_browser_process.yml +++ b/detections/endpoint/windows_disable_or_stop_browser_process.yml @@ -1,8 +1,8 @@ name: Windows Disable or Stop Browser Process id: 220d34b7-b6c7-45fe-8dbb-c35cdd9fe6d5 -version: 15 +version: 16 creation_date: '2024-10-18' -modification_date: '2026-08-14' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: TTP diff --git a/detections/endpoint/windows_dns_query_request_to_tinyurl.yml b/detections/endpoint/windows_dns_query_request_to_tinyurl.yml index cc66fe2bfe0..59ea9e2036e 100644 --- a/detections/endpoint/windows_dns_query_request_to_tinyurl.yml +++ b/detections/endpoint/windows_dns_query_request_to_tinyurl.yml @@ -2,7 +2,7 @@ name: Windows DNS Query Request To TinyUrl id: b1ea79da-719c-437c-acaf-5c93f838f425 version: 5 creation_date: '2021-11-18' -modification_date: '2026-05-13' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -23,6 +23,10 @@ search: | "*\\Temp\\*", "*\\Users\\Public\\*", "*\\Windows\\Tasks\\*" + "*\\powershell.exe", + "*\\pwsh.exe", + "*\\cmd.exe", + "*\\python.exe", ) | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count dvc process_exec process_guid process_name query query_count @@ -58,6 +62,7 @@ threat_objects: type: process_name analytic_story: - Malicious Inno Setup Loader + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1105 diff --git a/detections/endpoint/windows_password_managers_discovery.yml b/detections/endpoint/windows_password_managers_discovery.yml index 7ad0eb58cc6..c5294dd898f 100644 --- a/detections/endpoint/windows_password_managers_discovery.yml +++ b/detections/endpoint/windows_password_managers_discovery.yml @@ -1,8 +1,8 @@ name: Windows Password Managers Discovery id: a3b3bc96-1c4f-4eba-8218-027cac739a48 -version: 13 +version: 14 creation_date: '2022-12-06' -modification_date: '2026-05-13' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -55,6 +55,7 @@ analytic_story: - Prestige Ransomware - Scattered Spider - Scattered Lapsus$ Hunters + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1555.005 diff --git a/detections/endpoint/windows_python_process_accessing_facebook_domain.yml b/detections/endpoint/windows_python_process_accessing_facebook_domain.yml new file mode 100644 index 00000000000..55f7fc5839e --- /dev/null +++ b/detections/endpoint/windows_python_process_accessing_facebook_domain.yml @@ -0,0 +1,60 @@ +name: Windows Python Process Accessing Facebook Domain +id: d6dc231e-8595-499b-889e-cf6a055df4d4 +version: 1 +creation_date: '2026-10-06' +modification_date: '2026-10-06' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: This analytic detects outbound network connections from a Python process (python.exe) running out of the C:\Users\Public\ directory to Facebook domains (*.facebook.com). It leverages Sysmon Event ID 3 (network connection) telemetry to identify this suspicious combination. Legitimate Python applications rarely originate from the Public folder, and direct outbound calls to Facebook from that path are a strong indicator of malicious activity. The Braodo Stealer, a Python-based credential-harvesting malware, uses Facebook infrastructure for command-and-control communication and exfiltration of stolen credentials. If confirmed malicious, this activity indicates an active Braodo Stealer infection capable of exfiltrating browser-stored credentials, cookies, and other sensitive data from the compromised endpoint. +data_source: + - Sysmon EventID 3 +search: |- + `sysmon` + EventCode=3 + Image = "C:\\Users\\Public\\*" AND process_name = python.exe AND DestinationHostname = "*.facebook.com" direction = outbound + | stats count min(_time) as firstTime + max(_time) as lastTime + by action app dest dest_ip dest_port direction dvc protocol protocol_version + src src_ip src_port transport user vendor_product process_name + process_exec process_guid process_id + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_python_process_accessing_facebook_domain_filter` +how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and sysmon eventcode = 3 connection events from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: No false positives have been identified at this time. +references: + - https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: A Python Process Accessing Facebook Domain on $dest$ by $user$ +analytic_story: + - Braodo Stealer +asset_type: Endpoint +mitre_attack_id: + - T1586.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1586.001/python_fb/python_facebook.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml index dc872242386..f1d6a09ed25 100644 --- a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml +++ b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml @@ -1,8 +1,8 @@ name: Windows DNS Query Request by Telegram Bot API id: 86f66f44-94d9-412d-a71d-5d8ed0fef72e -version: 12 +version: 13 creation_date: '2021-08-03' -modification_date: '2026-07-20' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -47,6 +47,7 @@ analytic_story: - VIP Keylogger - Phantom Stealer - Starland RAT Campaign + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1071.004 From 6f229620d76623e73834689cbce84d9e5ac8a007 Mon Sep 17 00:00:00 2001 From: Teoderick Contreras Date: Tue, 6 Oct 2026 13:57:27 +0200 Subject: [PATCH 02/12] braodo_2026 --- detections/endpoint/windows_dns_query_request_to_tinyurl.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_dns_query_request_to_tinyurl.yml b/detections/endpoint/windows_dns_query_request_to_tinyurl.yml index 59ea9e2036e..ee152361a01 100644 --- a/detections/endpoint/windows_dns_query_request_to_tinyurl.yml +++ b/detections/endpoint/windows_dns_query_request_to_tinyurl.yml @@ -1,6 +1,6 @@ name: Windows DNS Query Request To TinyUrl id: b1ea79da-719c-437c-acaf-5c93f838f425 -version: 5 +version: 6 creation_date: '2021-11-18' modification_date: '2026-10-06' author: Teoderick Contreras, Splunk From fceabccf2a44a99e30b301eed239e7f6550f113b Mon Sep 17 00:00:00 2001 From: Teoderick Contreras Date: Wed, 7 Oct 2026 09:49:14 +0200 Subject: [PATCH 03/12] braodo_2026 --- ...download_script_from_public_free_project_repo.yml} | 6 +++--- stories/braodo_stealer.yml | 11 ++++++----- 2 files changed, 9 insertions(+), 8 deletions(-) rename detections/endpoint/{powershell_download_script_from_github.yml => powershell_download_script_from_public_free_project_repo.yml} (94%) diff --git a/detections/endpoint/powershell_download_script_from_github.yml b/detections/endpoint/powershell_download_script_from_public_free_project_repo.yml similarity index 94% rename from detections/endpoint/powershell_download_script_from_github.yml rename to detections/endpoint/powershell_download_script_from_public_free_project_repo.yml index a917ff1c28d..e90cd6cb2f9 100644 --- a/detections/endpoint/powershell_download_script_from_github.yml +++ b/detections/endpoint/powershell_download_script_from_public_free_project_repo.yml @@ -1,4 +1,4 @@ -name: PowerShell Download Script From Github +name: PowerShell Download Script From Public Free Project Repo id: 3ffbd4d4-84a7-453e-9e06-8e9cd0350366 version: 1 creation_date: '2026-10-06' @@ -13,14 +13,14 @@ search: |- `powershell` EventCode=4104 ScriptBlockText IN ("*.DownloadFile(*", "*.DownloadData(*", "*.DownloadString(*", "*Invoke-WebRequest*", "*Invoke-RestMethod*", "*Start-BitsTransfer*") | where match( ScriptBlockText, - "(?i)https?://github\.com/[^/\s]+/[^/\s]+/raw/(main|master)/[^\s'\"]+(.bat|.js|.vbs)" + "(?i)https?://(github|gitlab)\.com/[^/\s]+/[^/\s]+/(-/)?raw/(main|master)/[^\s'\"]+\.(bat|js|vbs|vbe)" ) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `powershell_download_script_from_github_filter` + | `powershell_download_script_from_public_free_project_repo_filter` how_to_implement: o successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba. known_false_positives: Note that false positives may occur due to the use of the Download cmdlet by legitimate users, such as system administrators. It is recommended to apply appropriate filters as needed to minimize the number of false positives. references: diff --git a/stories/braodo_stealer.yml b/stories/braodo_stealer.yml index f2ffbf3f1b2..78eb1d173cd 100644 --- a/stories/braodo_stealer.yml +++ b/stories/braodo_stealer.yml @@ -1,15 +1,16 @@ name: Braodo Stealer id: ec5c8721-3c13-45ac-90e8-64c63a8fdc24 -version: 2 -creation_date: '2024-10-15' -modification_date: '2026-05-13' +version: 3 +creation_date: ‘2024-10-15’ +modification_date: ‘2026-10-07’ author: Teoderick Contreras, Splunk status: production -description: Leverage searches that allow you to detect and investigate unusual activities that may be related to the Braodo Stealer malware, a malicious software designed to steal sensitive information from infected systems. This malware typically targets login credentials, browser history, cookies, and stored passwords. Braodo Stealer often infiltrates through phishing campaigns or malicious downloads, enabling attackers to gain unauthorized access to personal and financial data. By monitoring unusual system behaviors, such as unauthorized network connections or data exfiltration, you can help prevent data breaches and mitigate the impact of this threat. -narrative: Braodo Stealer is a stealthy and dangerous piece of malware specifically engineered to siphon sensitive information from compromised systems. Often spread through phishing emails or disguised as legitimate downloads, it silently infiltrates a victim’s device. Once inside, it scours through browser histories, steals login credentials, captures cookies, and even extracts saved passwords from various applications. With this stolen data, cybercriminals can gain access to banking accounts, social media profiles, or business platforms. What makes Braodo Stealer particularly threatening is its ability to remain undetected, allowing attackers to exploit compromised systems for extended periods before the user becomes aware. +description: Leverage searches that allow you to detect and investigate unusual activities that may be related to the Braodo Stealer malware, a malicious software designed to steal sensitive information from infected systems. This malware typically targets login credentials, browser history, cookies, and stored passwords. Beyond credential theft, recent variants of Braodo Stealer abuse authenticated Facebook sessions to query the Meta Graph API, enumerating advertising accounts, Facebook Pages, and Business Manager infrastructure — including account balances, spending limits, payment thresholds, and associated credit-card payment methods. Braodo Stealer often infiltrates through phishing campaigns or malicious downloads, enabling attackers to gain unauthorized access to personal and financial data. By monitoring unusual system behaviors, such as unauthorized network connections to Meta Graph API endpoints or data exfiltration, you can help prevent data breaches and mitigate the impact of this threat. +narrative: "Braodo Stealer is a stealthy and dangerous piece of malware specifically engineered to siphon sensitive information from compromised systems. Often spread through phishing emails or disguised as legitimate downloads, it silently infiltrates a victim’s device. Once inside, it scours through browser histories, steals login credentials, captures cookies, and extracts saved passwords from various applications. In its latest observed variants, Braodo Stealer goes beyond traditional credential theft by leveraging stolen Facebook session cookies to query the Meta Graph API. Using an authenticated session obtained from the victim’s browser, the malware enumerates advertising accounts, Facebook Pages, and Business Manager accounts associated with the victim. For each discovered asset, it collects account IDs, status, currency, current balances, spending amounts, spending limits, payment thresholds, creation dates, and details about associated credit-card payment methods. For Business Manager accounts, it additionally checks advertising-account limits, giving the attacker a comprehensive picture of the victim’s advertising infrastructure and financial exposure. With this stolen data, cybercriminals can hijack advertising accounts to run malicious ad campaigns, drain pre-funded ad balances, or sell access to high-value Business Manager accounts. What makes Braodo Stealer particularly threatening is its ability to remain undetected while quietly profiling victims’ financial and advertising assets, allowing attackers to maximize monetization long after the initial compromise." references: - https://bazaar.abuse.ch/browse/tag/Braodo/ - https://g0njxa.medium.com/from-vietnam-to-united-states-malware-fraud-and-dropshipping-98b7a7b2c36d + - https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html category: - Data Destruction - Malware From 8b1c54bcee6423bb351e65bed3760f261971a26b Mon Sep 17 00:00:00 2001 From: Teoderick Contreras Date: Wed, 7 Oct 2026 13:37:52 +0200 Subject: [PATCH 04/12] braodo_2026 --- stories/braodo_stealer.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/stories/braodo_stealer.yml b/stories/braodo_stealer.yml index 78eb1d173cd..a7ac246301b 100644 --- a/stories/braodo_stealer.yml +++ b/stories/braodo_stealer.yml @@ -1,8 +1,8 @@ name: Braodo Stealer id: ec5c8721-3c13-45ac-90e8-64c63a8fdc24 version: 3 -creation_date: ‘2024-10-15’ -modification_date: ‘2026-10-07’ +creation_date: '2024-10-15' +modification_date: '2026-10-07' author: Teoderick Contreras, Splunk status: production description: Leverage searches that allow you to detect and investigate unusual activities that may be related to the Braodo Stealer malware, a malicious software designed to steal sensitive information from infected systems. This malware typically targets login credentials, browser history, cookies, and stored passwords. Beyond credential theft, recent variants of Braodo Stealer abuse authenticated Facebook sessions to query the Meta Graph API, enumerating advertising accounts, Facebook Pages, and Business Manager infrastructure — including account balances, spending limits, payment thresholds, and associated credit-card payment methods. Braodo Stealer often infiltrates through phishing campaigns or malicious downloads, enabling attackers to gain unauthorized access to personal and financial data. By monitoring unusual system behaviors, such as unauthorized network connections to Meta Graph API endpoints or data exfiltration, you can help prevent data breaches and mitigate the impact of this threat. From 6b08f21cdd89bddd92b8ba6496494e11668e1173 Mon Sep 17 00:00:00 2001 From: Teoderick Contreras Date: Thu, 8 Oct 2026 13:36:53 +0200 Subject: [PATCH 05/12] braodo_2026 --- ...thon_process_accessing_facebook_domain.yml | 24 ++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/windows_python_process_accessing_facebook_domain.yml b/detections/endpoint/windows_python_process_accessing_facebook_domain.yml index 55f7fc5839e..ebeb0acd1c9 100644 --- a/detections/endpoint/windows_python_process_accessing_facebook_domain.yml +++ b/detections/endpoint/windows_python_process_accessing_facebook_domain.yml @@ -12,7 +12,29 @@ data_source: search: |- `sysmon` EventCode=3 - Image = "C:\\Users\\Public\\*" AND process_name = python.exe AND DestinationHostname = "*.facebook.com" direction = outbound + Image IN ( + "C:\\Users\\Public\\*", + "*\\windows\\fonts\\*", + "*\\windows\\debug\\*", + "*\\Users\\Administrator\\Music\\*", + "*Recycle.bin*", + "*\\Windows\\Media\\*", + "\\Windows\\repair\\*", + "*\\PerfLogs\\*", + "*:\\Windows\\Prefetch\\*", + "*:\\Windows\\Cursors\\*", + "*:\\Windows\\INF\\*" + ) AND + process_name IN ( + python.exe, + python2*.exe, + python3*.exe, + py.exe, + pythonw.exe, + py.exe, + pypy.exe) AND + DestinationHostname IN ("*.facebook.com", "*.fb.com", "*.facebook.net", "*.facebook.org", "*.fbcd.net", "*.fbsbx.com", "*.tfbw.net", "*.fbstatic-a.akamaihd.net" ) AND + direction = outbound | stats count min(_time) as firstTime max(_time) as lastTime by action app dest dest_ip dest_port direction dvc protocol protocol_version From fda28c9b9d1a3943c080ddbc676b746d58e3b052 Mon Sep 17 00:00:00 2001 From: Teoderick Contreras Date: Fri, 9 Oct 2026 10:06:55 +0200 Subject: [PATCH 06/12] braodo_2026 --- detections/endpoint/windows_dns_query_request_to_tinyurl.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_dns_query_request_to_tinyurl.yml b/detections/endpoint/windows_dns_query_request_to_tinyurl.yml index ee152361a01..19d561e114b 100644 --- a/detections/endpoint/windows_dns_query_request_to_tinyurl.yml +++ b/detections/endpoint/windows_dns_query_request_to_tinyurl.yml @@ -22,7 +22,7 @@ search: | "*\\ProgramData\\*", "*\\Temp\\*", "*\\Users\\Public\\*", - "*\\Windows\\Tasks\\*" + "*\\Windows\\Tasks\\*", "*\\powershell.exe", "*\\pwsh.exe", "*\\cmd.exe", From 5d953e64fd0f4c1b90074b29877ac5f0303b44ee Mon Sep 17 00:00:00 2001 From: Teoderick Contreras Date: Fri, 9 Oct 2026 13:04:13 +0200 Subject: [PATCH 07/12] braodo_2026 --- ...powershell_download_script_from_public_free_project_repo.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/powershell_download_script_from_public_free_project_repo.yml b/detections/endpoint/powershell_download_script_from_public_free_project_repo.yml index e90cd6cb2f9..cc36f64aab6 100644 --- a/detections/endpoint/powershell_download_script_from_public_free_project_repo.yml +++ b/detections/endpoint/powershell_download_script_from_public_free_project_repo.yml @@ -13,7 +13,7 @@ search: |- `powershell` EventCode=4104 ScriptBlockText IN ("*.DownloadFile(*", "*.DownloadData(*", "*.DownloadString(*", "*Invoke-WebRequest*", "*Invoke-RestMethod*", "*Start-BitsTransfer*") | where match( ScriptBlockText, - "(?i)https?://(github|gitlab)\.com/[^/\s]+/[^/\s]+/(-/)?raw/(main|master)/[^\s'\"]+\.(bat|js|vbs|vbe)" + "(?i)(?i)https?://(raw\.githubusercontent\.com/[^/\s]+/[^/\s]+/(main|master)|(github|gitlab)\.com/[^/\s]+/[^/\s]+/(-/)?raw/(main|master))/[^\s'\"]+\.(bat|js|vbs|vbe)" ) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime From d3ebe7f4d041ae4a507bd635aaaf12f4d27d9f84 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Tue, 13 Oct 2026 18:48:51 +0200 Subject: [PATCH 08/12] update powershell rule --- ...ell_download_from_code_hosting_service.yml | 90 +++++++++++++++++++ ...d_script_from_public_free_project_repo.yml | 60 ------------- 2 files changed, 90 insertions(+), 60 deletions(-) create mode 100644 detections/endpoint/powershell_download_from_code_hosting_service.yml delete mode 100644 detections/endpoint/powershell_download_script_from_public_free_project_repo.yml diff --git a/detections/endpoint/powershell_download_from_code_hosting_service.yml b/detections/endpoint/powershell_download_from_code_hosting_service.yml new file mode 100644 index 00000000000..076d4fc332e --- /dev/null +++ b/detections/endpoint/powershell_download_from_code_hosting_service.yml @@ -0,0 +1,90 @@ +name: PowerShell Download from Code Hosting Service +id: 3ffbd4d4-84a7-453e-9e06-8e9cd0350366 +version: 1 +creation_date: '2026-10-06' +modification_date: '2026-10-13' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: |- + This analytic detects PowerShell Script Block Logging (Event ID 4104) events that use common download methods to retrieve files directly from raw-content URLs on GitHub, GitLab, or Codeberg. + These code hosting services can be abused to stage payloads, but administrators and developers also download files from them. + A match identifies a download attempt; it does not establish that the file was successfully retrieved or executed. Review the full script block, destination path, process ancestry, and related endpoint activity. +data_source: + - Powershell Script Block Logging 4104 +search: |- + `powershell` EventCode=4104 ScriptBlockText IN ("*.DownloadFile(*", "*.DownloadData(*", "*.DownloadString(*", "*Invoke-WebRequest*", "*Invoke-RestMethod*", "*Start-BitsTransfer*", "*iwr *", "*irm *", "*curl *", "*wget *") + | where match( + ScriptBlockText, + "(?ix) + (?: + \.Download(?:File|Data|String)\s*\(\s*['\"]? + | + (?:Invoke-WebRequest|Invoke-RestMethod|iwr|irm) + (?:\s+(?:-Uri\s+)?|\b[^;\r\n]{0,200}?\s-Uri\s+)['\"]? + | + Start-BitsTransfer\b[^;\r\n]{0,200}?-Source\s+['\"]? + | + (?:curl|wget)\s+(?:-Uri\s+)?['\"]? + ) + https?:// + (?: + raw\.githubusercontent\.com/[^/\s'\"]+/[^/\s'\"]+/[^/\s'\"]+(?:/[^/\s'\"]+)* + | + (?:github|gitlab)\.com/[^/\s'\"]+/[^/\s'\"]+/(?:-/)?raw/(?:refs/(?:heads|tags)/)?[^/\s'\"]+(?:/[^/\s'\"]+)* + | + codeberg\.org/[^/\s'\"]+/[^/\s'\"]+/raw/(?:branch/)?[^/\s'\"]+(?:/[^/\s'\"]+)* + ) + \.(?:bat|cmd|ps1|js|vbs|vbe|py|zip|7z|rar|tar|gz|exe|dll|msi) + (?:[?#][^\s'\"]*)? + (?=['\"\s),;]|$)" + ) + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime + by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_download_from_code_hosting_service_filter` +how_to_implement: |- + To implement this analytic, enable PowerShell Script Block Logging and ingest Event ID 4104 events with the `ScriptBlockText` field extracted. + Confirm that the `powershell` macro scopes the search to the correct PowerShell Operational logs in your environment. +known_false_positives: |- + Administrators, developers, and software deployment tools may download legitimate files from GitHub, GitLab, and Codeberg. + Review repository ownership, the downloaded file, destination path, signer where applicable, process ancestry, and subsequent execution before taking action. +references: + - https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html + - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.6 +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: A PowerShell script on [$dest$] invoked a download method with a raw code-hosting URL in ScriptBlockText with ScriptBlockId [$ScriptBlockId$]. +analytic_story: + - Braodo Stealer +asset_type: Endpoint +mitre_attack_id: + - T1059.001 + - T1105 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_github/powershell_githu_download.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/powershell_download_script_from_public_free_project_repo.yml b/detections/endpoint/powershell_download_script_from_public_free_project_repo.yml deleted file mode 100644 index cc36f64aab6..00000000000 --- a/detections/endpoint/powershell_download_script_from_public_free_project_repo.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: PowerShell Download Script From Public Free Project Repo -id: 3ffbd4d4-84a7-453e-9e06-8e9cd0350366 -version: 1 -creation_date: '2026-10-06' -modification_date: '2026-10-06' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic detects PowerShell script block activity where download cmdlets such as DownloadFile, DownloadData, DownloadString, Invoke-WebRequest, Invoke-RestMethod, or Start-BitsTransfer are used to fetch script files (.bat, .js, .vbs) directly from raw GitHub content URLs. It leverages PowerShell Script Block Logging (Event ID 4104) to capture the full script text at execution time. Adversaries, including those deploying the Braodo Stealer, abuse raw GitHub URLs as a living-off-the-land staging mechanism to host and retrieve second-stage payloads, bypassing traditional download-site blocklists. If confirmed malicious, this activity indicates an active download-and-execute chain that could lead to credential theft, persistence, or further malware deployment on the affected endpoint. -data_source: - - Powershell Script Block Logging 4104 -search: |- - `powershell` EventCode=4104 ScriptBlockText IN ("*.DownloadFile(*", "*.DownloadData(*", "*.DownloadString(*", "*Invoke-WebRequest*", "*Invoke-RestMethod*", "*Start-BitsTransfer*") - | where match( - ScriptBlockText, - "(?i)(?i)https?://(raw\.githubusercontent\.com/[^/\s]+/[^/\s]+/(main|master)|(github|gitlab)\.com/[^/\s]+/[^/\s]+/(-/)?raw/(main|master))/[^\s'\"]+\.(bat|js|vbs|vbe)" - ) - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `powershell_download_script_from_public_free_project_repo_filter` -how_to_implement: o successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba. -known_false_positives: Note that false positives may occur due to the use of the Download cmdlet by legitimate users, such as system administrators. It is recommended to apply appropriate filters as needed to minimize the number of false positives. -references: - - https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html -drilldown_searches: - - name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ - - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: 7d - latest_offset: "0" -intermediate_findings: - entities: - - field: dest - type: system - score: 20 - message: PowerShell was identified running a Download Cmdlet to download Script on $dest$ by $user$ -analytic_story: - - Braodo Stealer -asset_type: Endpoint -mitre_attack_id: - - T1059.001 -product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud -category: endpoint -security_domain: endpoint -tests: - - name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_github/powershell_githu_download.log - source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: XmlWinEventLog - test_type: unit From 5243c10ce104a6c8f86db2629ae6cd1a11e818cc Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Tue, 13 Oct 2026 18:49:29 +0200 Subject: [PATCH 09/12] Update powershell_download_from_code_hosting_service.yml --- .../endpoint/powershell_download_from_code_hosting_service.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/powershell_download_from_code_hosting_service.yml b/detections/endpoint/powershell_download_from_code_hosting_service.yml index 076d4fc332e..2611e6247ec 100644 --- a/detections/endpoint/powershell_download_from_code_hosting_service.yml +++ b/detections/endpoint/powershell_download_from_code_hosting_service.yml @@ -69,6 +69,7 @@ intermediate_findings: type: system score: 20 message: A PowerShell script on [$dest$] invoked a download method with a raw code-hosting URL in ScriptBlockText with ScriptBlockId [$ScriptBlockId$]. +threat_objects: [] analytic_story: - Braodo Stealer asset_type: Endpoint From 728f020a0b9a3dc1ff9db2f39bfe5016b2ba4a7e Mon Sep 17 00:00:00 2001 From: Teoderick Contreras Date: Wed, 14 Oct 2026 10:46:45 +0200 Subject: [PATCH 10/12] braodo_2026 --- ...n.yml => windows_process_social_media_domain_access.yml} | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) rename detections/endpoint/{windows_python_process_accessing_facebook_domain.yml => windows_process_social_media_domain_access.yml} (71%) diff --git a/detections/endpoint/windows_python_process_accessing_facebook_domain.yml b/detections/endpoint/windows_process_social_media_domain_access.yml similarity index 71% rename from detections/endpoint/windows_python_process_accessing_facebook_domain.yml rename to detections/endpoint/windows_process_social_media_domain_access.yml index ebeb0acd1c9..0f00254d654 100644 --- a/detections/endpoint/windows_python_process_accessing_facebook_domain.yml +++ b/detections/endpoint/windows_process_social_media_domain_access.yml @@ -1,4 +1,4 @@ -name: Windows Python Process Accessing Facebook Domain +name: Windows Process Social Media Domain Access id: d6dc231e-8595-499b-889e-cf6a055df4d4 version: 1 creation_date: '2026-10-06' @@ -6,7 +6,7 @@ modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: This analytic detects outbound network connections from a Python process (python.exe) running out of the C:\Users\Public\ directory to Facebook domains (*.facebook.com). It leverages Sysmon Event ID 3 (network connection) telemetry to identify this suspicious combination. Legitimate Python applications rarely originate from the Public folder, and direct outbound calls to Facebook from that path are a strong indicator of malicious activity. The Braodo Stealer, a Python-based credential-harvesting malware, uses Facebook infrastructure for command-and-control communication and exfiltration of stolen credentials. If confirmed malicious, this activity indicates an active Braodo Stealer infection capable of exfiltrating browser-stored credentials, cookies, and other sensitive data from the compromised endpoint. +description: This analytic detects outbound network connections from a Python process running from suspicious or non-standard directories to Facebook and Meta-related domains. It leverages Sysmon Event ID 3 (network connection) telemetry to surface this anomalous behavior. Legitimate Python applications rarely originate from paths such as C:\Users\Public\, Windows font or debug folders, or the Recycle Bin, making direct outbound calls to Facebook infrastructure from these locations a strong indicator of compromise. For example the Braodo Stealer, a Python-based credential-harvesting malware, abuses authenticated browser sessions to query the Meta Graph API and enumerate the victim's Facebook and Meta advertising infrastructure. Beyond stealing browser credentials and session cookies, it collects advertising account IDs, statuses, currencies, balances, spending amounts and limits, payment thresholds, creation dates, and associated credit-card payment method details. For Business Manager accounts, it also queries advertising-account limits, giving the attacker a comprehensive view of the victim's advertising footprint. If confirmed malicious, this activity indicates an active Braodo Stealer infection capable of exfiltrating sensitive financial and advertising data alongside browser-stored credentials and cookies. data_source: - Sysmon EventID 3 search: |- @@ -42,7 +42,7 @@ search: |- process_exec process_guid process_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_python_process_accessing_facebook_domain_filter` + | `windows_process_social_media_domain_access_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and sysmon eventcode = 3 connection events from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: No false positives have been identified at this time. references: From addfde421fd0de56885cae35b3ab2283a764bf03 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 19 Oct 2026 00:44:19 +0200 Subject: [PATCH 11/12] update metadata --- ...ound_connection_to_social_media_domain.yml | 107 ++++++++++++++++++ ...ows_process_social_media_domain_access.yml | 82 -------------- 2 files changed, 107 insertions(+), 82 deletions(-) create mode 100644 detections/endpoint/windows_process_outbound_connection_to_social_media_domain.yml delete mode 100644 detections/endpoint/windows_process_social_media_domain_access.yml diff --git a/detections/endpoint/windows_process_outbound_connection_to_social_media_domain.yml b/detections/endpoint/windows_process_outbound_connection_to_social_media_domain.yml new file mode 100644 index 00000000000..20207c5a705 --- /dev/null +++ b/detections/endpoint/windows_process_outbound_connection_to_social_media_domain.yml @@ -0,0 +1,107 @@ +name: Windows Process Outbound Connection To Social Media Domain +id: d6dc231e-8595-499b-889e-cf6a055df4d4 +version: 1 +creation_date: '2026-10-06' +modification_date: '2026-10-06' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: |- + This analytic detects outbound network connections from a Python process running from suspicious or non-standard directories to social media related domains. + It leverages Sysmon Event ID 3 to surface this anomalous behavior. + Legitimate Python applications rarely originate from paths such as "C:\Users\Public\", Windows font or debug folders, or the Recycle Bin, making direct outbound calls to social media infrastructure from these locations a strong indicator of compromise. + For example the Braodo Stealer, a Python-based credential-harvesting malware, abuses authenticated browser sessions to query the Meta Graph API and enumerate the victim's Facebook and Meta advertising infrastructure. +data_source: + - Sysmon EventID 3 +search: |- + `sysmon` + EventCode=3 + Image IN ( + "*:\\$Recycle.Bin\\*", + "*:\\PerfLogs\\*", + "*:\\Users\\Administrator\\Music\\*", + "*:\\Users\\Public\\*", + "*:\\Windows\\Cursors\\*", + "*:\\Windows\\debug\\*", + "*:\\Windows\\fonts\\*", + "*:\\Windows\\INF\\*", + "*:\\Windows\\Media\\*", + "*:\\Windows\\Prefetch\\*", + "*\\Windows\\repair\\*" + ) + + process_name IN ( + "py.exe", + "pypy.exe", + "python.exe", + "python2*.exe", + "python3*.exe", + "pythonw.exe" + ) + + dest IN ( + "*.facebook.com", + "*.facebook.net", + "*.facebook.org", + "*.fb.com", + "*.fbcd.net", + "*.fbsbx.com", + "*.fbstatic-a.akamaihd.net", + "*.tfbw.net" + ) + direction = outbound + + | rename Image as process_path + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by action app dest dest_ip dest_port direction dvc protocol protocol_version + process_path process_name process_guid process_id + src src_ip src_port transport user vendor_product + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_process_outbound_connection_to_social_media_domain_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting logs with the process name and sysmon eventcode = 3 connection events from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: |- + No false positives have been identified at this time. +references: + - https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$src$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: A python process located in [$process_path$] with the name [$process_name$] and GUID [$process_guid$] and ID [$process_id$] was observed accessing a social media domain [$dest$] +threat_objects: + - field: process_path + type: file_path +analytic_story: + - Braodo Stealer +asset_type: Endpoint +mitre_attack_id: + - T1586.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1586.001/python_fb/python_facebook.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_process_social_media_domain_access.yml b/detections/endpoint/windows_process_social_media_domain_access.yml deleted file mode 100644 index 0f00254d654..00000000000 --- a/detections/endpoint/windows_process_social_media_domain_access.yml +++ /dev/null @@ -1,82 +0,0 @@ -name: Windows Process Social Media Domain Access -id: d6dc231e-8595-499b-889e-cf6a055df4d4 -version: 1 -creation_date: '2026-10-06' -modification_date: '2026-10-06' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic detects outbound network connections from a Python process running from suspicious or non-standard directories to Facebook and Meta-related domains. It leverages Sysmon Event ID 3 (network connection) telemetry to surface this anomalous behavior. Legitimate Python applications rarely originate from paths such as C:\Users\Public\, Windows font or debug folders, or the Recycle Bin, making direct outbound calls to Facebook infrastructure from these locations a strong indicator of compromise. For example the Braodo Stealer, a Python-based credential-harvesting malware, abuses authenticated browser sessions to query the Meta Graph API and enumerate the victim's Facebook and Meta advertising infrastructure. Beyond stealing browser credentials and session cookies, it collects advertising account IDs, statuses, currencies, balances, spending amounts and limits, payment thresholds, creation dates, and associated credit-card payment method details. For Business Manager accounts, it also queries advertising-account limits, giving the attacker a comprehensive view of the victim's advertising footprint. If confirmed malicious, this activity indicates an active Braodo Stealer infection capable of exfiltrating sensitive financial and advertising data alongside browser-stored credentials and cookies. -data_source: - - Sysmon EventID 3 -search: |- - `sysmon` - EventCode=3 - Image IN ( - "C:\\Users\\Public\\*", - "*\\windows\\fonts\\*", - "*\\windows\\debug\\*", - "*\\Users\\Administrator\\Music\\*", - "*Recycle.bin*", - "*\\Windows\\Media\\*", - "\\Windows\\repair\\*", - "*\\PerfLogs\\*", - "*:\\Windows\\Prefetch\\*", - "*:\\Windows\\Cursors\\*", - "*:\\Windows\\INF\\*" - ) AND - process_name IN ( - python.exe, - python2*.exe, - python3*.exe, - py.exe, - pythonw.exe, - py.exe, - pypy.exe) AND - DestinationHostname IN ("*.facebook.com", "*.fb.com", "*.facebook.net", "*.facebook.org", "*.fbcd.net", "*.fbsbx.com", "*.tfbw.net", "*.fbstatic-a.akamaihd.net" ) AND - direction = outbound - | stats count min(_time) as firstTime - max(_time) as lastTime - by action app dest dest_ip dest_port direction dvc protocol protocol_version - src src_ip src_port transport user vendor_product process_name - process_exec process_guid process_id - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_process_social_media_domain_access_filter` -how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and sysmon eventcode = 3 connection events from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: No false positives have been identified at this time. -references: - - https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html -drilldown_searches: - - name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ - - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: 7d - latest_offset: "0" -intermediate_findings: - entities: - - field: dest - type: system - score: 20 - message: A Python Process Accessing Facebook Domain on $dest$ by $user$ -analytic_story: - - Braodo Stealer -asset_type: Endpoint -mitre_attack_id: - - T1586.001 -product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud -category: endpoint -security_domain: endpoint -tests: - - name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1586.001/python_fb/python_facebook.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog - test_type: unit From e9fce02c3b01741499f6b6b9f64b11f3a117fdbc Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 19 Oct 2026 00:45:55 +0200 Subject: [PATCH 12/12] Update braodo_stealer.yml --- stories/braodo_stealer.yml | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/stories/braodo_stealer.yml b/stories/braodo_stealer.yml index a7ac246301b..c55ebb63d5a 100644 --- a/stories/braodo_stealer.yml +++ b/stories/braodo_stealer.yml @@ -5,8 +5,20 @@ creation_date: '2024-10-15' modification_date: '2026-10-07' author: Teoderick Contreras, Splunk status: production -description: Leverage searches that allow you to detect and investigate unusual activities that may be related to the Braodo Stealer malware, a malicious software designed to steal sensitive information from infected systems. This malware typically targets login credentials, browser history, cookies, and stored passwords. Beyond credential theft, recent variants of Braodo Stealer abuse authenticated Facebook sessions to query the Meta Graph API, enumerating advertising accounts, Facebook Pages, and Business Manager infrastructure — including account balances, spending limits, payment thresholds, and associated credit-card payment methods. Braodo Stealer often infiltrates through phishing campaigns or malicious downloads, enabling attackers to gain unauthorized access to personal and financial data. By monitoring unusual system behaviors, such as unauthorized network connections to Meta Graph API endpoints or data exfiltration, you can help prevent data breaches and mitigate the impact of this threat. -narrative: "Braodo Stealer is a stealthy and dangerous piece of malware specifically engineered to siphon sensitive information from compromised systems. Often spread through phishing emails or disguised as legitimate downloads, it silently infiltrates a victim’s device. Once inside, it scours through browser histories, steals login credentials, captures cookies, and extracts saved passwords from various applications. In its latest observed variants, Braodo Stealer goes beyond traditional credential theft by leveraging stolen Facebook session cookies to query the Meta Graph API. Using an authenticated session obtained from the victim’s browser, the malware enumerates advertising accounts, Facebook Pages, and Business Manager accounts associated with the victim. For each discovered asset, it collects account IDs, status, currency, current balances, spending amounts, spending limits, payment thresholds, creation dates, and details about associated credit-card payment methods. For Business Manager accounts, it additionally checks advertising-account limits, giving the attacker a comprehensive picture of the victim’s advertising infrastructure and financial exposure. With this stolen data, cybercriminals can hijack advertising accounts to run malicious ad campaigns, drain pre-funded ad balances, or sell access to high-value Business Manager accounts. What makes Braodo Stealer particularly threatening is its ability to remain undetected while quietly profiling victims’ financial and advertising assets, allowing attackers to maximize monetization long after the initial compromise." +description: |- + Leverage searches that allow you to detect and investigate unusual activities that may be related to the Braodo Stealer malware, a malicious software designed to steal sensitive information from infected systems. + This malware typically targets login credentials, browser history, cookies, and stored passwords. + Beyond credential theft, recent variants of Braodo Stealer abuse authenticated Facebook sessions to query the Meta Graph API, enumerating advertising accounts, Facebook Pages, and Business Manager infrastructure — including account balances, spending limits, payment thresholds, and associated credit-card payment methods. + Braodo Stealer often infiltrates through phishing campaigns or malicious downloads, enabling attackers to gain unauthorized access to personal and financial data. By monitoring unusual system behaviors, such as unauthorized network connections to Meta Graph API endpoints or data exfiltration, you can help prevent data breaches and mitigate the impact of this threat. +narrative: |- + Braodo Stealer is a stealthy and dangerous piece of malware specifically engineered to siphon sensitive information from compromised systems. + Often spread through phishing emails or disguised as legitimate downloads, it silently infiltrates a victim’s device. + Once inside, it scours through browser histories, steals login credentials, captures cookies, and extracts saved passwords from various applications. + In its latest observed variants, Braodo Stealer goes beyond traditional credential theft by leveraging stolen Facebook session cookies to query the Meta Graph API. + Using an authenticated session obtained from the victim’s browser, the malware enumerates advertising accounts, Facebook Pages, and Business Manager accounts associated with the victim. + For each discovered asset, it collects account IDs, status, currency, current balances, spending amounts, spending limits, payment thresholds, creation dates, and details about associated credit-card payment methods. For Business Manager accounts, it additionally checks advertising-account limits, giving the attacker a comprehensive picture of the victim’s advertising infrastructure and financial exposure. + With this stolen data, cybercriminals can hijack advertising accounts to run malicious ad campaigns, drain pre-funded ad balances, or sell access to high-value Business Manager accounts. + What makes Braodo Stealer particularly threatening is its ability to remain undetected while quietly profiling victims’ financial and advertising assets, allowing attackers to maximize monetization long after the initial compromise. references: - https://bazaar.abuse.ch/browse/tag/Braodo/ - https://g0njxa.medium.com/from-vietnam-to-united-states-malware-fraud-and-dropshipping-98b7a7b2c36d