Yuta/Glove Stealer: .NET WPF Lure Dropping PyInstaller Payload to AppData Cache
This rule detects suspicious activities commonly associated with the Yuta/Glove information stealer, including the creation of specific file paths in AppData, the execution of binaries from user-writable directories, and potential process hollowing or side-loading behaviors. It monitors process creation (Event ID 1) and file creation (Event ID 11) for indicators like winupdate.exe, PyInstaller-related temporary directories, and known malicious file hashes.
Splunk (SPL)
