title: Suspicious Wallpaper Engine Child Process
id: 6a5c4d2a-1b8c-4a3e-9d6f-2e7b8c9d0a1f
description: Detects suspicious child processes spawned by Wallpaper Engine, potentially indicating malware execution from malicious Steam Workshop items.
status: experimental
date: 2026/06/17
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\\wallpaper32.exe'
      - '\\wallpaper_engine.exe'
  selection_child:
    Image|endswith:
      - '\\powershell.exe'
      - '\\cmd.exe'
      - '\
undll32.exe'
      - '\
egsvr32.exe'
      - '\\wscript.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate user scripts (rare)
level: high
tags:
  - attack.execution
  - attack.t1204
---
title: Potential DragonForce BYOVD Driver Load
id: 7b6e5f3b-2c9d-5b4f-0e7g-3f8c9d0e1b2f
description: Detects the loading of vulnerable drivers often exploited by DragonForce and other ransomware actors for BYOVD attacks (e.g., RTCore64, PROCWORM).
status: experimental
date: 2026/06/17
author: Security Arsenal
logsource:
  category: driver_load
  product: windows
detection:
  selection:
    Signed: 'true'
    Subject|contains:
      - 'RTCore'
      - 'DBUtil_2_3'
      - 'AsIO'
      - 'EnTech'
      - 'PROCMON24'
  condition: selection
falsepositives:
  - Legitimate software installing hardware utilities (MSI Afterburner, ASUS utilities)
level: high
tags:
  - attack.privilege_escalation
  - attack.t1068
---
title: Gremlin Stealer Suspicious VM/Obfuscation Artifacts
id: 8c7f0g4c-3d0e-6c5g-1f8h-4g9d0e1f2c3g
description: Detects characteristics of process hollowing or VM-based obfuscation often used by advanced stealers like Gremlin.
status: experimental
date: 2026/06/17
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_generic:
    Image|endswith:
      - '\\mshta.exe'
      - '\
egsvr32.exe'
  selection_cli:
    CommandLine|contains:
      - 'scraping'
      - 'token'
      - 'stealer'
  condition: 1 of selection_*
falsepositives:
  - Administrative scripts
level: medium
tags:
  - attack.defense_evasion
  - attack.t1027


kql
// Hunt for Steam Wallpaper Engine spawning suspicious processes
DeviceProcessEvents 
| where InitiatingProcessFolderPath has @\"Steam\\steamapps\\common\\wallpaper_engine\" 
| where ProcessCommandLine contains \"powershell\" or ProcessCommandLine contains \"cmd\" 
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath

// Hunt for specific DragonForce and Gremlin IOCs (File Hashes)
DeviceFileEvents 
| where SHA256 in (\"8a4033425d36cd99fe23e6faef9764fbf555f362ebdb5b72379342fbbe4c5531\", 
                   \"048e18416177de2ead251abdf4d89837f6807c6aba4d5b1debe49adfdecbf05c\",
                   \"1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5\")
| project Timestamp, DeviceName, FileName, FolderPath, SHA256

// Network connections to DragonForce related IPs
DeviceNetworkEvents 
| where RemoteIP in (\"185.196.9.234\") 
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl


powershell
# IOC Hunt Script: Scan for Malicious Files associated with DragonForce, Gremlin, and Steam Campaigns
# Requires Administrator Privileges

$TargetHashes = @(
    \"8a4033425d36cd99fe23e6faef9764fbf555f362ebdb5b72379342fbbe4c5531\",
    \"048e18416177de2ead251abdf4d89837f6807c6aba4d5b1debe49adfdecbf05c\",
    \"1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5\",
    \"fc586cad94e5a10dd5be6a6ae6096bd02dfbfd094365bec87e788ed0798d6f67\"
)

$PathsToScan = @(
    \"$env:USERPROFILE\\Downloads\",
    \"$env:USERPROFILE\\Desktop\",
    \"$env:TEMP\",
    \"C:\\Program Files\\Steam\\steamapps\\common\\wallpaper_engine\"
)

Write-Host \"[+] Starting scan for known malicious IoCs...\" -ForegroundColor Cyan

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Write-Host \"[!] Scanning directory: $Path\" -ForegroundColor Yellow
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $FileHash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($TargetHashes -contains $FileHash) {
                Write-Host \"[!!!] MALICIOUS FILE DETECTED: $($_.FullName)\" -ForegroundColor Red
                Write-Host \"     Hash: $FileHash\" -ForegroundColor Red
            }
        }
    }
}

# Check for suspicious persistence (Steam Wallpaper Startup)
$StartupPath = \"$env:APPDATA\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\"
if (Test-Path $StartupPath) {
    Write-Host \"[!] Checking Startup Folder for suspicious Wallpaper Engine artifacts...\" -ForegroundColor Yellow
    Get-ChildItem -Path $StartupPath -ErrorAction SilentlyContinue | ForEach-Object {
        if ($_.Name -like \"*wallpaper*\" -or $_.Name -like \"*steam*\") {
            Write-Host \"[?] Suspicious startup item found: $($_.Name)\" -ForegroundColor DarkYellow
        }
    }
}

Write-Host \"[+] Scan complete.\" -ForegroundColor Cyan


# Response Priorities

**Immediate (0-24h)**:
*   **Block IOCs**: Push all file hashes, domains (`leadslaw.com`, `fifaticket2026vip.com`), and IPs (`185.196.9.234`) to blocking lists (Firewall, Proxy, EDR).
*   **Hunt for Steam Artifacts**: Scan endpoints for processes spawned by `wallpaper32.exe` and investigate RAR files in Downloads folders from the dates mentioned.
*   **Vulnerability Scan**: Assess exposure to CVE-2023-36036, CVE-2023-52271, and CVE-2025-61155.

**24h - 48h**:
*   **Identity Verification**: If credential theft is suspected (Vidar/Lumma/Gremlin), force reset passwords for accounts accessed from suspicious geographic locations or IP ranges associated with DragonForce activity.
*   **Teams Traffic Analysis**: Review logs for anomalous usage of Microsoft Teams relay services by non-standard endpoints.

**1 Week**:
*   **Architecture Hardening**: Implement strict application allowlisting for gaming software in corporate environments. Restrict the use of consumer-grade collaboration tools for C2-like traffic patterns.
*   **User Awareness**: Update security awareness training to include risks associated with "free" assets in gaming platforms and World Cup-themed phishing.