Steam Platform Malware Campaign: FBI Alert, Detection, and Incident Response Guide

---
title: Steam Client Spawning System Shell
id: 85a3b4c1-9d6e-4f2a-a8b0-1c2d3e4f5a6b
status: experimental
description: Detects Steam client spawning cmd.exe, powershell.exe, or wscript.exe. Legitimate games rarely invoke system shells directly.
references:
  - https://www.fbi.gov/news/stories
author: Security Arsenal
date: 2024/05/22
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: 'steam'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate game mods (rare)
  - Steam troubleshooting by user
level: high
---
title: Suspicious Network Connection from Steam Common Directory
id: 92c1d5e2-0a7f-4b3c-9d8e-1f2a3b4c5d6e
status: experimental
description: Detects executables in the Steam "steamapps" directory establishing non-Steam network connections to external IPs.
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2024/05/22
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|contains: '\steamapps\common\'
    DestinationPort:
      - 443
      - 80
    Initiated: 'true'
  filter_legit_steam:
    DestinationIpAddress|contains:
      - '192.16' 
      - '162.254' 
      - '208.64'
  condition: selection and not filter_legit_steam
falsepositives:
  - Multiplayer games connecting to custom servers
level: medium
---
title: Steam Game Executable Persisting to Startup Folder
id: 73f0a4b1-8e2c-4d1a-b3c5-9e8f0a1b2c3d
status: experimental
description: Detects a process running from the Steam library attempting to write a file to the Windows Startup folder for persistence.
references:
  - https://attack.mitre.org/techniques/T1547/
author: Security Arsenal
date: 2024/05/22
tags:
  - attack.persistence
  - attack.t1547
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|contains: '\steamapps\common\'
    TargetFilename|contains: '\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\'
  condition: selection
falsepositives:
  - Legitimate game launchers configuring auto-start (verify binary reputation)
level: high

// KQL for Microsoft Sentinel / Defender 365
// Hunt for Steam processes spawning suspicious child processes
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFolderPath has @"Steam" 
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "regsvr32.exe", "rundll32.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, FolderPath
| order by Timestamp desc

-- Velociraptor VQL Artifact
-- Hunt for suspicious child processes of Steam
SELECT Pid, Name, CommandLine, Exe, Username, Parent.Pid as ParentPid, Parent.Name as ParentName
FROM pslist()
WHERE Parent.Name =~ "steam.exe" OR Parent.Name =~ "steamwebhelper.exe"
  AND Name IN ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "bash", "sh")

# Remediation Script: Steam Library Verification
# Identifies unsigned executables in Steam library folders (High Triage Value)

$SteamPath = "${env:ProgramFiles(x86)}\Steam"
if (-not (Test-Path $SteamPath)) {
    $SteamPath = "$env:ProgramFiles\Steam"
}

$LibraryFolders = @()
$ConfigFile = "$SteamPath\steamapps\libraryfolders.vdf"

if (Test-Path $ConfigFile) {
    # Parse VDF to find library locations (Basic parsing logic)
    $Content = Get-Content $ConfigFile
    $Matches = [regex]::Matches($Content, '"path"\s+"([^"]+)"')
    foreach ($Match in $Matches) {
        $LibraryFolders += $Match.Groups[1].Value
    }
} else {
    Write-Warning "Steam config not found."
}

# Default path if parsing failed or not found
$DefaultApps = Join-Path -Path $SteamPath -ChildPath "steamapps\common"
if (Test-Path $DefaultApps) { $LibraryFolders += $DefaultApps }

Write-Host "Scanning Steam Libraries for Unsigned Executables..." -ForegroundColor Cyan

foreach ($Lib in $LibraryFolders) {
    $CommonPath = Join-Path -Path $Lib -ChildPath "steamapps\common"
    if (Test-Path $CommonPath) {
        Get-ChildItem -Path $CommonPath -Filter *.exe -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $Sig = Get-AuthenticodeSignature -FilePath $_.FullName
            if ($Sig.Status -ne "Valid") {
                [PSCustomObject]@{
                    File = $_.FullName
                    Status = $Sig.Status
                    Signer = $Sig.SignerCertificate.Subject
                }
            }
        }
    }
}