Detecting Lumma Stealer Commands
Query
DeviceFileEvents
| extend CommandWords = split(InitiatingProcessCommandLine, " ") // Split the command into words
| extend Word1 = CommandWords[0], // First word
Word2 = CommandWords[1], // Second word
Word3 = CommandWords[2], // Third word
Word4 = CommandWords[3], // Fourth word
Word5 = CommandWords[4]
| extend LongestWord = case(
strlen(Word1) >= strlen(Word2) and strlen(Word1) >= strlen(Word3) and strlen(Word1) >= strlen(Word4) and strlen(Word1) >= strlen(Word5), Word1,
strlen(Word2) >= strlen(Word1) and strlen(Word2) >= strlen(Word3) and strlen(Word2) >= strlen(Word4) and strlen(Word2) >= strlen(Word5), Word2,
strlen(Word3) >= strlen(Word1) and strlen(Word3) >= strlen(Word2) and strlen(Word3) >= strlen(Word4) and strlen(Word3) >= strlen(Word5), Word3,
strlen(Word4) >= strlen(Word1) and strlen(Word4) >= strlen(Word2) and strlen(Word4) >= strlen(Word3) and strlen(Word4) >= strlen(Word5), Word4,
Word5 // Default case if Column5 is the longest
)
| extend tostring(LongestWord)
| extend DecodedBytes = base64_decode_tostring(LongestWord)
| extend DecodedString = tostring(DecodedBytes)
| where DecodedString contains "mshta" or InitiatingProcessCommandLine contains "mshta"
| distinct DeviceName,InitiatingProcessCommandLine,LongestWord,DecodedStringAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1218.005 | System Binary Proxy Execution: Mshta |
Author: Sergio Albea (14/01/2025)
Detecting Lumma Stealer commands
One of the techniques used to distribute the Lumma Stealer malware is via command lines using the native Windows application mshta which is an HTML tool for executing scripts. This KQL Query helps to identify commands that use the aforementioned application and also those that use the application and also those that use powershell and encode the malicious code in base64.
Explanation
This KQL (Kusto Query Language) query is designed to detect potential malicious activity related to the Lumma Stealer malware. It focuses on identifying suspicious command lines that use the Windows application mshta, which can execute scripts and is sometimes used for malicious purposes.
Here's a simplified breakdown of what the query does:
-
Data Source: It starts by looking at
DeviceFileEvents, which likely contains logs of file-related activities on devices. -
Command Splitting: The query splits the command line used to initiate a process into individual words. It then identifies the first five words in the command line.
-
Longest Word Identification: Among the first five words, it determines which one is the longest. This is done to potentially identify encoded or suspiciously long strings that might contain malicious code.
-
Base64 Decoding: The longest word is decoded from Base64 encoding, which is a common method used to obfuscate malicious code.
-
Filtering: The query filters for command lines that either contain the word "mshta" or have a decoded string that contains "mshta". This helps in identifying commands that use
mshtadirectly or indirectly. -
Distinct Results: Finally, it returns distinct results showing the device name, the original command line, the longest word, and the decoded string. This helps in pinpointing specific instances of suspicious activity.
Overall, the query is a tool for security analysts to detect and investigate potential threats involving the misuse of mshta to execute malicious scripts, particularly those associated with the Lumma Stealer malware.
