Detecting the Loader-to-Stealer Chain

Stealers are frequently delivered by loaders, some sold as pay-per-install services, through cracked software, malvertising, email and fake updates. The loader downloads an encrypted payload and runs it inside a trusted process, often a .NET host from the framework directory. Detecting the hand-off finds the stealer before the theft, and finds the loader even when the stealer is new.

Signals at a Glance

Trusted Hosts That Should Be Quiet

The .NET command-line tools used for builds and registration rarely make network connections on a normal endpoint. When a stealer is hollowed into one, that is its first visible act. This rule is cheap and high value:

title: Network Connection from .NET Utility Often Used as Injection Host
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    Image|endswith:
      - '\RegAsm.exe'
      - '\RegSvcs.exe'
      - '\MSBuild.exe'
      - '\InstallUtil.exe'
      - '\AppLaunch.exe'
      - '\jsc.exe'
      - '\vbc.exe'
  filter_internal:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_internal
level: high
# tune/validate: build servers and developer machines run MSBuild with network access

Hunting the Hand-Off

Look at lineage as well as the connection. A utility spawned by a binary in a user-writable path, with no meaningful command line, is the hollowing pattern:

// Microsoft Defender (KQL) - .NET utilities launched by user-writable parents
DeviceProcessEvents
| where FileName in~ ("RegAsm.exe","RegSvcs.exe","MSBuild.exe","InstallUtil.exe","AppLaunch.exe","jsc.exe","vbc.exe")
| where InitiatingProcessFolderPath has_any ("\\AppData\\","\\Temp\\","\\ProgramData\\","\\Users\\Public\\","\\Downloads\\")
| where ProcessCommandLine endswith FileName or ProcessCommandLine endswith strcat(FileName, "\"")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine
// tune/validate: developer workstations and CI agents need a scoped exclusion

• Block execution from user-writable paths and from extracted archives with application control; it breaks most commodity loader chains at the first step.
• Alert on the loader, not just the stealer: a loader that fetched one payload will fetch the next, so scope the host for other families.
• Check the loader’s persistence; see the persistence page, because the loader is usually what survives cleanup.