Yuta/Glove Stealer: Non-Browser Process Making DeepSeek API Calls (T1204.002)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects network connections from suspicious process paths (e.g., AppData, Temp, Downloads) or processes/command-lines associated with Roblox-related game executors (e.g., Solara, Yuta) to DeepSeek domains. This rule helps identify potentially malicious tools or scripts attempting to communicate with external infrastructure often used by such utilities.