Lucid Stealer Staging Artifacts

Kaung Khant Ko@kaungkhantko

•updated Jun 9, 2026•7•0•21

Detects the creation of specific staging archives and log files used by Lucid Stealer before exfiltration. This rule looks for 'uac.log.txt', 'lucid_err.log', or 'Data_*.zip' files being created in the user's local temporary directory.