oak_techniques: [OAK-T4.013]
spec_id: oak-detection-T4.013
version: 0.1.0
maturity: emerging
maintainer: "@iZonex"
license: Apache-2.0

scope: |
  Detect commodity infostealer malware (RedLine / Vidar / Lumma / Fickle class)
  that harvests cryptocurrency wallet material and authentication state at rest
  from a victim endpoint — browser-extension wallet vaults, desktop-wallet files
  (wallet.dat / keystores / mnemonic files), saved browser credentials, and
  session cookies / auth tokens used for live session hijacking — and exfiltrates
  it. Detection operates at the endpoint (browser/wallet-store access behaviour,
  EDR stealer signatures), at the network egress (archive exfiltration to bot/C2),
  and at the platform-account layer (session reuse without authentication).
  Excludes: T4.012 (clipper — clipboard substitution of in-flight destination);
  T11.006 (seed material at rest in a third-party storage service, not the host);
  T15.003 / T15.004 (operator / enterprise endpoint, not commodity consumer host).

data_sources: [endpoint_process_telemetry, file_access_events, browser_store_access, network_flow, auth_session_events]

detection_logic:
  description: |
    Three detection paths. PATH A (endpoint harvest behaviour): flag a process
    that reads multiple browser-profile stores (Login Data, Cookies, extension
    Local Storage / IndexedDB) and known wallet-application data directories in
    rapid succession, then writes/uploads a compressed archive — especially a
    short-lived child of a loader/dropper. PATH B (exfiltration egress): flag an
    archive POST to a Telegram bot endpoint / paste service / freshly-registered
    C2 immediately after browser-and-wallet-store reads. PATH C (session-hijack,
    platform side): flag reuse of a session token from a new device fingerprint
    or geo with no corresponding authentication (password/MFA) event — the
    value-realisation half of cookie theft.
  pseudocode: |
    WALLET_PATHS  ← { browser_extension_vaults(MetaMask, Phantom, TrustWallet, Rabby, Keplr, ...),
                      desktop_wallet_dirs(Exodus, Electrum, Atomic, "Bitcoin/wallet.dat"),
                      keystore_and_mnemonic_files }
    BROWSER_STORES ← { "Login Data", "Cookies", "Local Storage", "IndexedDB" }

    # PATH A — endpoint harvest behaviour
    for each process P on host H:
      reads ← files_read(P, within=harvest_window_ms)
      if count_paths(reads ∩ BROWSER_STORES) ≥ store_hit_threshold
         and any(reads ∩ WALLET_PATHS)
         and P.writes_archive_or_uploads():
        emit(PATH_A, host=H, proc=P, wallet_hits=reads ∩ WALLET_PATHS,
             staged_by=P.parent_if_loader(), severity=critical)

    # PATH B — exfiltration egress
    for each network_flow F from process P on host H:
      if P.recently(matched PATH_A) and F.dest in { telegram_bot_api, paste_service, fresh_c2 }
         and F.payload_is_archive():
        emit(PATH_B, host=H, proc=P, dest=F.dest, severity=critical)

    # PATH C — session-hijack at platform / exchange
    for each session_use U on account A:
      if U.device_fingerprint ∉ A.known_devices and U.geo ∉ A.known_geo
         and not preceded_by_auth_event(A, within=session_auth_window):
        emit(PATH_C, account=A, session=U.token_id, new_device=U.device_fingerprint,
             severity=high)

parameters:
  harvest_window_ms:    { type: integer, default: 5000 }   # read-burst proximity
  store_hit_threshold:  { type: integer, default: 2 }      # distinct browser stores touched
  session_auth_window:  { type: integer, default: 300 }    # seconds; auth must precede reuse

output_alert: [oak_technique, detection_path, severity, host, process, parent_loader,
               wallet_hits, browser_store_hits, exfil_dest, account, session_token,
               new_device_fingerprint, evidence]

test_fixtures:
  positive:
    - 2026-06-steam-workshop-wallpaper-engine-infostealer   # Lumma/Vidar via Steam Workshop wallpapers, Steam-session hijack + wallet theft
  negative:
    - "A backup utility legitimately reading wallet directories with the user's consent and no network exfiltration"
    - "A browser-sync feature reading its own Login Data store in-process — not a foreign process scraping it"
    - "A clipper substituting a copied address with no read of wallet vaults or browser credential stores — T4.012"
    - "A user logging in from a new device with a fresh password + MFA authentication event preceding the session — not a hijacked session"

false_positive_modes:
  - Password managers / backup tools reading credential or wallet directories with user consent — distinguish via foreign-process access plus archive exfiltration to external C2
  - Legitimate cross-device session continuation behind a CDN/VPN that shifts geo — PATH C requires both new device fingerprint and absent authentication event
  - Security/forensic tooling enumerating wallet artefacts — allowlist known EDR/backup agents

mitigations: [OAK-M19, OAK-M22, OAK-M30, OAK-M40, OAK-M21, OAK-M18]

reference_implementations:
  - { target: microsoft-defender, chain: cross-chain, url: "" }
  - { target: kaspersky,          chain: cross-chain, url: "" }
  - { target: exchange-session-binding, chain: cross-chain, url: "" }