Steam Wallpaper - Steam Config File Reads

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•2

This rule detects attempts by a malicious cache wrapper (specifically, a process named `._cache_GAME1.exe`) to access local Steam configuration files, which could indicate token harvesting. The rule looks for file access events on paths containing `\config\loginusers.vdf` initiated by the specified malicious process.