Stolen Images Execution

Description

The "Stolen Images" Bazarloader campaign uses fake copyright infingement contact form emails and malicious files pretending to contain "stolen images" to trick users into downloading the malware.

Query · kql

DeviceProcessEvents
| where FileName =~ "wscript.exe" and ProcessCommandLine has_all("stolen", "images")
Raw source Stolen Images Execution · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 0e959fe8-f086-4497-b538-60fb0b5d8e37
name: Stolen Images Execution
description: |
  The "Stolen Images" Bazarloader campaign uses fake copyright infingement contact form emails and malicious files pretending to contain "stolen images" to trick users into downloading the malware.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
query: |
  DeviceProcessEvents
  | where FileName =~ "wscript.exe" and ProcessCommandLine has_all("stolen", "images")

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.