objectivity_stealer

t-contreras · t-contreras · commit 897986eaa523 · 2025-08-25T18:46:15.000+02:00
diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml
@@ -67,7 +67,7 @@ tags:
   - RedLine Stealer
   - Log4Shell CVE-2021-44228
   - Interlock Rat
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   cve:
   - CVE-2021-44228
diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml
@@ -58,7 +58,7 @@ tags:
   - Snake Keylogger
   - XMRig
   - Water Gamayun
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   mitre_attack_id:
   - T1105
diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
@@ -75,7 +75,7 @@ tags:
   - Salt Typhoon
   - XWorm
   - DarkCrystal RAT
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   mitre_attack_id:
   - T1059.001
diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
@@ -67,7 +67,7 @@ tags:
   - FIN7
   - Snake Keylogger
   - China-Nexus Threat Activity
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   mitre_attack_id:
   - T1555.003
diff --git a/detections/endpoint/potential_telegram_api_request_via_commandline.yml b/detections/endpoint/potential_telegram_api_request_via_commandline.yml
@@ -72,7 +72,7 @@ tags:
   analytic_story:
   - XMRig
   - Water Gamayun
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   mitre_attack_id:
   - T1102.002
diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml
@@ -82,7 +82,7 @@ tags:
   - XWorm
   - Scattered Spider
   - Interlock Ransomware
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   mitre_attack_id:
   - T1059.001
diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
@@ -63,7 +63,7 @@ tags:
   - Hermetic Wiper
   - IcedID
   - XWorm
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   mitre_attack_id:
   - T1027
   - T1059.001
diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml
@@ -71,7 +71,7 @@ tags:
   - Hermetic Wiper
   - Malicious PowerShell
   - Data Destruction
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   mitre_attack_id:
   - T1059.001
diff --git a/detections/endpoint/randomly_generated_scheduled_task_name.yml b/detections/endpoint/randomly_generated_scheduled_task_name.yml
@@ -33,7 +33,7 @@ tags:
   - Active Directory Lateral Movement
   - CISA AA22-257A
   - Scheduled Tasks
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   mitre_attack_id:
   - T1053.005
diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml
@@ -115,7 +115,7 @@ tags:
   - Windows Persistence Techniques
   - MoonPeak
   - Interlock Ransomware
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   mitre_attack_id:
   - T1547.001
diff --git a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml
@@ -70,7 +70,7 @@ tags:
   - Active Directory Lateral Movement
   - Living Off The Land
   - Scheduled Tasks
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   mitre_attack_id:
   - T1053.002
diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
@@ -104,7 +104,7 @@ tags:
   - Windows Persistence Techniques
   - MoonPeak
   - Scattered Spider
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   mitre_attack_id:
   - T1053.005
diff --git a/detections/endpoint/windows_credential_access_from_browser_password_store.yml b/detections/endpoint/windows_credential_access_from_browser_password_store.yml
@@ -73,7 +73,7 @@ tags:
   - China-Nexus Threat Activity
   - Meduza Stealer
   - Scattered Spider
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   mitre_attack_id:
   - T1012
diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml
@@ -63,7 +63,7 @@ tags:
   - RedLine Stealer
   - Braodo Stealer
   - MoonPeak
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   mitre_attack_id:
   - T1012
diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml
@@ -70,7 +70,7 @@ tags:
   - MoonPeak
   - Snake Keylogger
   - China-Nexus Threat Activity
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   mitre_attack_id:
   - T1012
diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml
@@ -71,7 +71,7 @@ tags:
   - MoonPeak
   - Snake Keylogger
   - China-Nexus Threat Activity
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   mitre_attack_id:
   - T1012
diff --git a/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml
@@ -77,7 +77,7 @@ tags:
   - Windows Persistence Techniques
   - Ransomware
   - Ryuk Ransomware
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   mitre_attack_id:
   - T1053.005
diff --git a/detections/endpoint/windows_time_based_evasion_via_choice_exec.yml b/detections/endpoint/windows_time_based_evasion_via_choice_exec.yml
@@ -65,7 +65,7 @@ rba:
 tags:
   analytic_story:
   - Snake Keylogger
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   mitre_attack_id:
   - T1497.003
diff --git a/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml b/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml
@@ -56,7 +56,7 @@ tags:
   analytic_story:
   - Snake Keylogger
   - Meduza Stealer
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   mitre_attack_id:
   - T1552
diff --git a/detections/endpoint/windows_unusual_process_load_mozilla_nss_mozglue_module.yml b/detections/endpoint/windows_unusual_process_load_mozilla_nss_mozglue_module.yml
@@ -66,7 +66,7 @@ rba:
 tags:
   analytic_story:
   - Quasar RAT
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   mitre_attack_id:
   - T1218.003
diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
@@ -67,7 +67,7 @@ tags:
   - Windows Error Reporting Service Elevation of Privilege Vulnerability
   - Windows Persistence Techniques
   - Winter Vivern
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   mitre_attack_id:
   - T1053.005
diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
@@ -76,7 +76,7 @@ tags:
   - Prestige Ransomware
   - AsyncRAT
   - Windows Persistence Techniques
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   mitre_attack_id:
   - T1053.005
diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml
@@ -75,7 +75,7 @@ tags:
   - WhisperGate
   - Unusual Processes
   - ShrinkLocker
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   mitre_attack_id:
   - T1055
diff --git a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml
@@ -52,7 +52,7 @@ rba:
 tags:
   analytic_story:
   - Crypto Stealer
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   mitre_attack_id:
   - T1071.004
diff --git a/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml b/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml
@@ -68,7 +68,7 @@ tags:
   - Meduza Stealer
   - Water Gamayun
   - Quasar RAT
-  - Obj3ctivity Stealer
+  - 0bj3ctivity Stealer
   asset_type: Endpoint
   mitre_attack_id:
   - T1590.005
diff --git a/stories/0bj3ctivity_stealer.yml b/stories/0bj3ctivity_stealer.yml
@@ -1,4 +1,4 @@
-name: Obj3ctivity Stealer
+name: 0bj3ctivity Stealer
 id: 467ee9e6-6f84-424b-89d8-49a03581a4a9
 version: 3
 date: '2025-08-22'
