Defending Against the Surge in ACR Stealer Attacks: Detection and Incident Response

---
title: Potential Browser Credential Theft via Non-Browser Process
id: 8f4d9a12-1c3e-4b5a-9f6d-7e8c9a0b1c2d
status: experimental
description: Detects non-browser processes accessing browser credential databases (Login Data), a common behavior of stealers like ACR.
references:
  - https://attack.mitre.org/techniques/T1555/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1555.003
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\Default\Login Data'
      - '\Microsoft\Edge\User Data\Default\Login Data'
      - '\Mozilla\Firefox\Profiles\logins.'
  filter:
    Image|contains:
      - 'chrome.exe'
      - 'msedge.exe'
      - 'firefox.exe'
  condition: selection and not filter
falsepositives:
  - Legitimate backup software or security scanners accessing browser data
level: high
---
title: Suspicious Process Executing from User AppData Roaming
id: 9e5e0b23-2d4f-5c6b-0a7e-8f9d1a2b3c4e
status: experimental
description: Detects execution of unsigned binaries from the user's Roaming AppData directory, a common drop location for ACR Stealer payloads.
references:
  - https://attack.mitre.org/techniques/T1547/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1547.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains: '\AppData\Roaming\'
    Image|endswith: '.exe'
  filter:
    Image|contains:
      - '\Microsoft\Windows\Start Menu\Programs\Startup'
      - '\Google\Chrome\Application'
      - '\Microsoft\Edge\Application'
      - '\Mozilla Firefox'
  condition: selection and not filter
falsepositives:
  - Legitimate software installers or updates located in user profile
level: medium
---
title: PowerShell Suspicious Download String Common in Stealer Loaders
id: a1f2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects PowerShell commands often used in downloaders to fetch infostealer payloads like ACR.
references:
  - https://attack.mitre.org/techniques/T1059.001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'IEX'
      - 'DownloadString'
  condition: selection
falsepositives:
  - Administrative scripts
level: high

// Hunt for processes accessing sensitive browser files
DeviceFileEvents
| where Timestamp > ago(7d)
| where FileName in~ ("Login Data", "Cookies", "Web Data")
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "opera.exe")
| extend DeviceCustomEntity = DeviceName, AccountCustomEntity = InitiatingProcessAccountName, ProcessCustomEntity = InitiatingProcessFileName
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, ActionType

-- Hunt for suspicious executables in user AppData/Roaming created recently
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs='C:/Users/*/AppData/Roaming/*/*.exe')
WHERE Mtime > now() - 7days
  AND NOT IsDir
  AND Mode =~ "rwx"

-- Hunt for processes accessing Chrome Login Data
SELECT Name, Pid, UserName, Cmdline
FROM pslist()
WHERE Cmdline =~ 'Chrome\\User Data\\Default\\Login Data'
   AND NOT Name =~ 'chrome.exe'

# ACR Stealer Response Script
# Requires Administrator privileges

Write-Host "Starting ACR Stealer containment process..." -ForegroundColor Cyan

# 1. Identify common user paths for suspicious executables (AppData/Roaming and AppData/Local)
$suspiciousPaths = @(
    "$env:APPDATA\*.exe",
    "$env:LOCALAPPDATA\Temp\*.exe"
)

Write-Host "Scanning for recently created executables in user profiles..." -ForegroundColor Yellow
# Note: In a real IR scenario, hash verification against threat intelligence is preferred before deletion.
# This script lists potential artifacts for manual review.

Get-ChildItem -Path $env:APPDATA -Filter *.exe -Recurse -ErrorAction SilentlyContinue | 
Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } | 
Select-Object FullName, LastWriteTime, Length

# 2. Check for persistence in Run Keys
Write-Host "Checking Registry Run Keys for suspicious persistence..." -ForegroundColor Yellow
$runPaths = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

foreach ($path in $runPaths) {
    if (Test-Path $path) {
        Get-ItemProperty -Path $path | 
        Get-Member -MemberType NoteProperty | 
        Where-Object { $_.Name -notlike "PS*" } | 
        ForEach-Object { 
            $propName = $_.Name
            $propValue = (Get-ItemProperty -Path $path).$propName
            Write-Host "Key: $path | Value: $propName | Data: $propValue" -ForegroundColor White
        }
    }
}

Write-Host "Remediation script complete. Analyze output and verify hashes before deletion." -ForegroundColor Green