[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

guidance based on Varonis Stadia analysis (Oct 22)

Tip: check every Windows host for Defender exclusions and hidden repeating tasks that point into C:\ProgramData. Stadia and many stealers use both

Two quick checks catch a lot of commodity malware, including the new Stadia RAT:

  • Defender exclusions: Get-MpPreference | Select -Expand ExclusionPath (run as admin). Investigate any path under C:\ProgramData\ or a user profile that you didn't add. In bulk, Defender for Endpoint and Intune can report exclusions, or watch for PowerShell Add-MpPreference in script-block logs (4104).
  • Hidden repeating tasks: enable 'Audit Other Object Access Events' so Security events 4698 and 4702 are logged, then alert on task XML containing <Hidden>true</Hidden> and a short repetition interval that runs from ProgramData. Locally: Get-ScheduledTask | ? {$_.Settings.Hidden}.
  • Don't key detections only on schtasks.exe. Stadia registers its task through COM.

Sources: Varonis Threat Labs: StealC Is Back, and This Time It's a RAT