Lunex Stealer Abuses AMD Driver for BYOVD EDR-Kill and Browser Credential Theft — Detection and Defense Guide

---
title: ClickFix-Style Browser-Spawned Script Execution
id: 1f4a9c62-8e3d-4b71-a592-6c7d8e9f0a1b
status: experimental
description: Detects mshta, powershell, or rundll32 launched directly by a web browser, consistent with ClickFix fake-CAPTCHA paste-execution lures such as those delivering Lunex/Psychedelic Stealer.
references:
  - https://thehackernews.com/2026/09/lunex-stealer-abuses-amd-driver-to.html
  - https://attack.mitre.org/techniques/T1204/002/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/10
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\opera.exe'
  selection_child:
    Image|endswith:
      - '\mshta.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate enterprise browser extensions or internal tooling that shell out to script hosts
level: high
---
title: Kernel Driver Service Created From User-Writable Path (BYOVD)
id: 2b5c8d71-4f6a-4e92-b381-7d8e9f0a1b2c
status: experimental
description: Detects creation of a kernel driver service whose binary resides in a user-writable directory, a hallmark of BYOVD attacks such as Lunex Stealer loading a vulnerable AMD driver to terminate EDR processes.
references:
  - https://thehackernews.com/2026/09/lunex-stealer-abuses-amd-driver-to.html
  - https://attack.mitre.org/techniques/T1562/001/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/09/10
tags:
  - attack.defense_evasion
  - attack.t1562.001
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_sc:
    Image|endswith: '\sc.exe'
    CommandLine|contains:
      - 'create'
      - 'type= kernel'
  selection_path:
    CommandLine|contains:
      - '\AppData\'
      - '\Temp\'
      - '\Public\'
      - '\ProgramData\'
      - '\Downloads\'
  condition: selection_sc and selection_path
falsepositives:
  - Legitimate driver installers staging from ProgramData are rare but possible; validate signer and service name
level: critical
---
title: Non-Browser Process Accessing Browser Credential Stores
id: 3c6d9e82-5a7b-4f03-c492-8e9f0a1b2c3d
status: experimental
description: Detects processes other than the browser itself reading Chrome, Edge, Firefox, or other browser credential databases, consistent with infostealer behavior observed in Psychedelic Stealer after EDR impairment.
references:
  - https://thehackernews.com/2026/09/lunex-stealer-abuses-amd-driver-to.html
  - https://attack.mitre.org/techniques/T1555/003/
author: Security Arsenal
date: 2026/09/10
tags:
  - attack.credential_access
  - attack.t1555.003
logsource:
  category: file_access
  product: windows
detection:
  selection_files:
    TargetFilename|contains:
      - '\User Data\Default\Login Data'
      - '\User Data\Default\Cookies'
      - '\User Data\Local State'
      - '\Firefox\Profiles\'
      - '\logins.json'
      - '\key4.db'
  exclusion_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\opera.exe'
  condition: selection_files and not exclusion_browsers
falsepositives:
  - Enterprise backup agents, DLP scanners, and some password managers; allowlist known-good processes by hash
level: high

// Hunt: ClickFix lure + BYOVD staging + credential store access (Lunex / Psychedelic Stealer)
// Part 1: Browser-spawned script interpreters (ClickFix paste-execution)
let Browsers = dynamic(["chrome.exe","msedge.exe","firefox.exe","brave.exe","opera.exe"]);
let ScriptHosts = dynamic(["mshta.exe","powershell.exe","pwsh.exe","rundll32.exe","wscript.exe","cscript.exe","cmd.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ (Browsers)
| where FileName in~ (ScriptHosts)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, ReportId
| sort by TimeGenerated desc;

// Part 2: Driver files written to user-writable paths (BYOVD staging of AMD driver)
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FileName endswith ".sys"
| where FolderPath has_any ("\\AppData\\","\\Temp\\","\\Public\\","\\Downloads\\","\\ProgramData\\")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName,
          InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, SHA256;

// Part 3: Suspicious .sys loads reported by Defender tamper/driver telemetry
DeviceEvents
| where TimeGenerated > ago(14d)
| where ActionType has_any ("DriverLoad","IoCreateDriver")
| where FileName has_any ("amd") or AdditionalFields has "amd"
| where FolderPath !has "\\System32\\drivers\\"
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath,
          InitiatingProcessFileName, InitiatingProcessCommandLine, AdditionalFields;

-- Hunt: BYOVD staging and stealer artifacts (Lunex / Psychedelic Stealer)
-- Look for .sys drivers in user-writable paths AND processes touching browser credential stores
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)\\(AppData|Temp|Public|Downloads)\\.*\.(exe|dll|sys)$'
   OR CommandLine =~ '(?i)(Login Data|Local State|logins\.json|key4\.db|sc\.exe.*type=.*kernel)'

-- Enumerate staged driver files in user-writable locations
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='C:/Users/*/AppData/**/*.sys')
WHERE Mtime > now() - 1209600  -- last 14 days

# Lunex/Psychedelic Stealer defensive posture check + hardening (run as Administrator)
# 1. Verify Microsoft Vulnerable Driver Blocklist is enabled (blocks known-abused signed drivers)
$vdb = Get-CimInstance -Namespace "root\Microsoft\Windows\DeviceGuard" -ClassName Win32_DeviceGuard -ErrorAction SilentlyContinue
if ($vdb) {
    Write-Host "[+] VBS/HVCI Services Running: $($vdb.SecurityServicesRunning)"
    Write-Host "[+] VBS Services Configured: $($vdb.SecurityServicesConfigured)"
} else {
    Write-Host "[-] Device Guard WMI class unavailable - verify Windows 10 1809+/Win11"
}

# 2. Enable the Vulnerable Driver Blocklist if not configured (1 = enabled)
$vdbPath = "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config"
$vdbValue = (Get-ItemProperty -Path $vdbPath -Name VulnerableDriverBlocklistEnable -ErrorAction SilentlyContinue).VulnerableDriverBlocklistEnable
if ($vdbValue -ne 1) {
    Set-ItemProperty -Path $vdbPath -Name VulnerableDriverBlocklistEnable -Value 1
    Write-Host "[!] Vulnerable Driver Blocklist ENABLED - reboot required"
} else {
    Write-Host "[+] Vulnerable Driver Blocklist already enabled"
}

# 3. Block mshta child execution vector via Attack Surface Reduction rule (ClickFix mitigation)
# ASR rule: Block abuse of exploited vulnerable signed drivers = 56a863a9-875e-4185-98a7-b882c64b5ce5
Add-MpPreference -AttackSurfaceReductionRules_Ids "56a863a9-875e-4185-98a7-b882c64b5ce5" -AttackSurfaceReductionRules_Actions Enabled
# ASR rule: Block process creations from PSExec/WMI + Office/script abuse (adjacent hardening)
Add-MpPreference -AttackSurfaceReductionRules_Ids "d1e49aac-8f56-4280-b9ba-993a6d77406c" -AttackSurfaceReductionRules_Actions Enabled
Write-Host "[+] ASR rules applied: vulnerable signed driver block + suspicious child processes"

# 4. Audit for staged .sys files in user-writable paths from the last 14 days
$paths = @("$env:SystemDrive\Users\*\AppData","$env:SystemDrive\Users\Public","$env:SystemDrive\ProgramData")
Get-ChildItem -Path $paths -Recurse -Filter *.sys -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
    Select-Object FullName, Length, LastWriteTime |
    Format-Table -AutoSize
Write-Host "[*] Review any .sys files above - drivers do not belong in user directories"

# 5. Enumerate recently created kernel driver services by non-standard paths
Get-CimInstance Win32_SystemDriver |
    Where-Object { $_.PathName -notmatch 'system32|SysWOW64|Program Files|Windows' -and $_.PathName -ne $null } |
    Select-Object Name, DisplayName, State, StartMode, PathName |
    Format-Table -AutoSize