Yuta/Glove Stealer AMSI and ETW In-Memory Patch via PyInstaller Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects anomalous loading of amsi.dll by processes running from suspicious staging paths commonly associated with the Yuta/Glove Stealer campaign. The rule identifies processes that may be performing in-memory patching of 'AmsiOpenSession' or 'EtwEventWrite' to blind security telemetry, a hallmark of credential theft malware.