Detecting RedLine Stealer: TTPs and Host Behaviours

RedLine is a .NET infostealer sold as malware-as-a-service and delivered through cracked software, malvertising and loader chains. Law-enforcement action against RedLine and its sibling META infrastructure in 2024 did not erase the code that was already in circulation. We do not list hashes or servers here, because they churn within days. Instead we cover the behaviours public analyses consistently document.

Signals at a Glance

Host Behaviours to Hunt

RedLine is a managed .NET assembly, so it commonly appears as a process running from a user-writable path or injected into a trusted .NET host. The collection phase touches many unrelated applications in a short window, which is the pattern to hunt. Start with the staging artifact, since Chromium locks the live database and stealers copy it:

// Microsoft Defender (KQL) - credential store copies created by a non-browser process
let Browsers = dynamic(["chrome.exe","msedge.exe","firefox.exe","brave.exe","opera.exe"]);
DeviceFileEvents
| where ActionType in ("FileCreated","FileRenamed")
| where FileName in~ ("Login Data","Cookies","Web Data","logins.json","key4.db")
| where InitiatingProcessFileName !in~ (Browsers)
| where FolderPath !has "\\User Data\\" and FolderPath !has "\\Profiles\\"
| project Timestamp, DeviceName, AccountName, FolderPath, FileName,
          InitiatingProcessFileName, InitiatingProcessFolderPath
// tune/validate: exclude backup, migration and EDR agents

Cleanup and Self-Deletion

After exfiltration the sample typically deletes itself with a delayed shell command. That short-lived cmd.exe child, spawned by a process in a user-writable path, is a useful second signal when the collection phase was missed:

title: Delayed Self-Deletion by Binary in User-Writable Path
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\AppData\'
      - '\Temp\'
      - '\Users\Public\'
  selection_cmd:
    Image|endswith: '\cmd.exe'
    CommandLine|contains:
      - 'timeout'
      - 'ping'
      - 'choice'
    CommandLine|contains|all:
      - 'del'
  condition: selection_parent and selection_cmd
level: medium
# tune/validate: installers and updaters self-delete; allowlist signed publishers

• Hunt the combination: store access, WMI profiling, a screenshot and one outbound connection from the same process within a few minutes.
• Hunt .NET hosts used for injection (such as RegAsm.exe and MSBuild.exe) making outbound connections; see the loader-to-stealer page.
• Treat any hit as full credential exposure for the user, including saved VPN and FTP credentials.