StealC Process and Security Software Enumeration via tasklist and Registry

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects reconnaissance activities characteristic of StealC malware, specifically the enumeration of running processes using 'tasklist.exe' and discovery of installed software by querying Uninstall registry keys. The detection focuses on these activities originating from suspicious user-writable directories like AppData, Temp, or ProgramData, which are often used by malware for execution.