Vidar - Extracting SQLite DLL Dependencies (T1105)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•3

Correlates the execution of the injected Vidar payload with the dropping of legitimate sqlite3.dll, nss3.dll, or freebl3.dll, which are required to parse and steal browser databases. This rule specifically looks for these DLLs being created on a device where the initiating process was 'AutoIt3.exe', indicating a potential Vidar stealer infection.