Steam Wallpaper - Wrapper Network to Payload Execution

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•1

This rule detects a sequence of events where a network connection to a specific URL pattern ('ey.php') is followed within one hour by the execution of a process named 'Synaptics.exe'. This behavior is indicative of the Steam Wallpaper malware, where an initial C2 ping by a wrapper leads to the execution of a subsequent payload.