Add BlankGrabber Stealer Related Analytics and Tagging

detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml

@@ -83,6 +83,7 @@ rba:
 tags:
     analytic_story:
         - Cisco Network Visibility Module Analytics
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1218.005

detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml

@@ -94,6 +94,7 @@ tags:
     analytic_story:
         - APT37 Rustonotto and FadeStealer
         - Cisco Network Visibility Module Analytics
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1197

detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml

@@ -111,6 +111,7 @@ rba:
 tags:
     analytic_story:
         - Cisco Network Visibility Module Analytics
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1105

detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml

@@ -88,6 +88,7 @@ tags:
     analytic_story:
         - Cisco Network Visibility Module Analytics
         - Castle RAT
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1590.005

detections/endpoint/detect_mshta_inline_hta_execution.yml

@@ -66,6 +66,7 @@ tags:
         - Suspicious MSHTA Activity
         - XWorm
         - APT37 Rustonotto and FadeStealer
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1218.005

detections/endpoint/disable_defender_submit_samples_consent_feature.yml

@@ -38,6 +38,7 @@ tags:
         - CISA AA23-347A
         - IcedID
         - Windows Registry Abuse
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1562.001

detections/endpoint/disable_windows_behavior_monitoring.yml

@@ -44,6 +44,7 @@ tags:
         - Scattered Lapsus$ Hunters
         - NetSupport RMM Tool Abuse
         - Storm-0501 Ransomware
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1562.001

detections/endpoint/excessive_usage_of_taskkill.yml

@@ -52,6 +52,7 @@ tags:
         - CISA AA22-264A
         - XMRig
         - Crypto Stealer
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1562.001

detections/endpoint/fodhelper_uac_bypass.yml

@@ -58,6 +58,7 @@ tags:
         - ValleyRAT
         - Compromised Windows Host
         - Windows Defense Evasion Tactics
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1112

detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml

@@ -58,6 +58,7 @@ tags:
         - DarkCrystal RAT
         - 0bj3ctivity Stealer
         - APT37 Rustonotto and FadeStealer
+        - BlankGrabber Stealer
         - MuddyWater
     asset_type: Endpoint
     mitre_attack_id:

detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml

@@ -48,6 +48,7 @@ tags:
         - Snake Keylogger
         - China-Nexus Threat Activity
         - Lokibot
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1555.003

detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml

@@ -50,6 +50,7 @@ tags:
         - China-Nexus Threat Activity
         - 0bj3ctivity Stealer
         - Lokibot
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1555.003

detections/endpoint/potential_telegram_api_request_via_commandline.yml

@@ -55,6 +55,7 @@ tags:
         - Water Gamayun
         - 0bj3ctivity Stealer
         - Hellcat Ransomware
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1102.002

detections/endpoint/powershell_disable_security_monitoring.yml

@@ -112,6 +112,7 @@ tags:
         - Ransomware
         - Revil Ransomware
         - CISA AA24-241A
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1562.001

detections/endpoint/powershell_windows_defender_exclusion_commands.yml

@@ -55,6 +55,7 @@ tags:
         - WhisperGate
         - Warzone RAT
         - NetSupport RMM Tool Abuse
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1562.001

detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml

@@ -93,6 +93,7 @@ tags:
         - Amadey
         - Gozi Malware
         - APT37 Rustonotto and FadeStealer
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1566.002

detections/endpoint/recon_using_wmi_class.yml

@@ -63,6 +63,7 @@ tags:
         - Qakbot
         - Industroyer2
         - Scattered Spider
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1592

detections/endpoint/system_information_discovery_detection.yml

@@ -45,6 +45,7 @@ tags:
         - Interlock Ransomware
         - LAMEHUG
         - NetSupport RMM Tool Abuse
+        - BlankGrabber Stealer
         - Lotus Blossom Chrysalis Backdoor
     asset_type: Windows
     mitre_attack_id:

detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml

@@ -47,6 +47,7 @@ tags:
         - Interlock Ransomware
         - APT37 Rustonotto and FadeStealer
         - PromptFlux
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1547.001

detections/endpoint/windows_clipboard_data_via_get_clipboard.yml

@@ -49,6 +49,7 @@ tags:
     analytic_story:
         - Windows Post-Exploitation
         - Prestige Ransomware
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1115

detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml

@@ -54,6 +54,7 @@ tags:
         - Water Gamayun
         - Tuoni
         - SolarWinds WHD RCE Post Exploitation
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1059.007

detections/endpoint/windows_computerdefaults_spawning_a_process.yml

@@ -47,6 +47,7 @@ rba:
 tags:
     analytic_story:
         - Castle RAT
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1548.002

detections/endpoint/windows_credential_access_from_browser_password_store.yml

@@ -47,6 +47,7 @@ tags:
         - Scattered Spider
         - 0bj3ctivity Stealer
         - Scattered Lapsus$ Hunters
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1012

detections/endpoint/windows_credentials_from_password_stores_chrome_copied_in_temp_dir.yml

@@ -34,6 +34,7 @@ tags:
     analytic_story:
         - Braodo Stealer
         - Scattered Lapsus$ Hunters
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1555.003

detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml

@@ -42,6 +42,7 @@ tags:
         - Braodo Stealer
         - MoonPeak
         - 0bj3ctivity Stealer
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1012

detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml

@@ -52,6 +52,7 @@ tags:
         - 0bj3ctivity Stealer
         - Lokibot
         - Scattered Lapsus$ Hunters
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1012

detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml

@@ -52,6 +52,7 @@ tags:
         - 0bj3ctivity Stealer
         - Lokibot
         - Scattered Lapsus$ Hunters
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1012

detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml

@@ -51,6 +51,7 @@ tags:
         - PXA Stealer
         - NjRAT
         - Crypto Stealer
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1562.001

detections/endpoint/windows_disable_or_stop_browser_process.yml

@@ -52,6 +52,7 @@ tags:
         - Scattered Lapsus$ Hunters
         - Hellcat Ransomware
         - Castle RAT
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1562.001

detections/endpoint/windows_eventlog_recon_activity_using_log_query_utilities.yml

@@ -106,6 +106,7 @@ rba:
 tags:
     analytic_story:
         - Windows Discovery Techniques
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1654

detections/endpoint/windows_hosts_file_access.yml

@@ -0,0 +1,76 @@
+name: Windows Hosts File Access
+id: b34bcf35-5380-4b00-b208-5531303fb751
+version: 1
+date: '2026-03-03'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+description: |
+    This Analytic detects the execution of a process attempting to access the hosts file.
+    The hosts file is a critical file for network configuration and DNS resolution.
+    If an attacker gains access to it, they can redirect traffic to malicious websites, serve fake content or block legitimate security websites.
+data_source:
+    - Windows Event Log Security 4663
+search: |
+    `wineventlog_security`
+    EventCode=4663
+    object_file_path="*:\\Windows\\System32\\drivers\\etc\\hosts"
+    NOT process_path IN (
+        "*:\\Windows\\explorer.exe",
+        "*:\\Windows\\System32\\lsass.exe",
+        "*:\\Windows\\System32\\SearchIndexer.exe",
+        "*:\\Windows\\System32\\services.exe",
+        "*:\\Windows\\System32\\svchost.exe",
+        "*:\\Windows\\SysWow64\\SearchIndexer.exe",
+        "*:\\Windows\\SysWow64\\svchost.exe"
+    )
+    | stats count
+        by _time object_file_path object_file_name dest process_name
+           process_path process_id EventCode
+    | eval process_path = lower(process_path)
+    | lookup browser_process_and_path browser_process_path as process_path OUTPUT is_valid_browser_path
+    | eval is_valid_browser_path=coalesce(is_valid_browser_path,"false")
+    | where is_valid_browser_path = "false"
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `windows_hosts_file_access_filter`
+how_to_implement: |
+    To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." This search may trigger on a browser application that is not included in the browser_app_list lookup file.
+known_false_positives: Administrator may access this registry for product key recovery purposes.
+references:
+    - https://cert.gov.ua/article/6284730
+drilldown_searches:
+    - name: View the detection results for - "$user$" and "$dest$"
+      search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$user$" and "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+rba:
+    message: A [$process_name$] attempting to access the hosts file [$object_file_path$] on [$dest$].
+    risk_objects:
+        - field: dest
+          type: system
+          score: 20
+    threat_objects:
+        - field: process_name
+          type: process_name
+tags:
+    analytic_story:
+        - BlankGrabber Stealer
+    asset_type: Endpoint
+    mitre_attack_id:
+        - T1012
+    product:
+        - Splunk Enterprise
+        - Splunk Enterprise Security
+        - Splunk Cloud
+    security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1012/host_file_accessed/hosts_accessed.log
+          source: XmlWinEventLog:Security
+          sourcetype: XmlWinEventLog

detections/endpoint/windows_impair_defense_disable_controlled_folder_access.yml

@@ -34,6 +34,7 @@ tags:
     analytic_story:
         - Windows Defense Evasion Tactics
         - Windows Registry Abuse
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1562.001

detections/endpoint/windows_impair_defense_disable_win_defender_network_protection.yml

@@ -35,6 +35,7 @@ tags:
         - Windows Defense Evasion Tactics
         - Windows Registry Abuse
         - Scattered Lapsus$ Hunters
+        - BlankGrabber Stealer
     asset_type: Endpoint
     mitre_attack_id:
         - T1562.001