{
  "title": "SystemHelpDesk Detection - Olgames (Infostealer) Execution & Triage",
  "id": "ba414aa5-6774-52e6-8290-f3199b127cba",
  "status": "production",
  "description": "Detects execution, defense evasion, and persistence behaviors associated with the Olgames malware family. Detects browser credential database harvesting, master key queries, and DPAPI extraction routines typical of modern infostealers.",
  "references": [
    "https://malware-families-catalog.systemhelpdesk.com/families/olgames",
    "https://malware-families-catalog.systemhelpdesk.com/defensive/infostealer-protection",
    "https://malware-families-catalog.systemhelpdesk.com/"
  ],
  "author": "Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP",
  "date": "2026-10-14",
  "modified": "2026-10-14",
  "tags": [
    "attack.infostealer",
    "author.ricky-jordan",
    "source.systemhelpdesk-mfc",
    "attack.t1056_001",
    "attack.t1055",
    "attack.t1555",
    "attack.t1071_001",
    "attack.t1547_001"
  ],
  "logsource": {
    "category": "process_creation",
    "product": "windows"
  },
  "detection": {
    "selection_process": {
      "Image|endswith": [
        "\\cmd.exe",
        "\\powershell.exe",
        "\\rundll32.exe"
      ],
      "CommandLine|contains": [
        "\\Google\\Chrome\\User Data\\Default\\Login Data",
        "\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles",
        "\\AppData\\Local\\Microsoft\\Edge\\User Data",
        "vaultcmd.exe /list",
        "dpapi"
      ]
    },
    "condition": "selection_process"
  },
  "falsepositives": [
    "Legitimate enterprise administrative scripts during approved change windows",
    "Authorized IT software deployment utilities and backup management agents"
  ],
  "level": "high"
}