Detection rules › Elastic
Malicious Ledger Live Execution
Detects unsigned binaries masquerading as "Ledger Live" cryptocurrency wallet software. These fake applications steal wallet seed phrases and private keys from victims through social engineering.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth |
Telemetry coverage
Rule body
[rule]
description = """
Detects unsigned binaries masquerading as "Ledger Live" cryptocurrency wallet software. These fake applications steal
wallet seed phrases and private keys from victims through social engineering.
"""
id = "49c1f843-2461-4714-bdb1-ec8f0d930afb"
license = "Elastic License v2"
name = "Malicious Ledger Live Execution"
os_list = ["macos"]
reference = ["https://x.com/moonlock_lab/status/1902381331490738345"]
version = "1.0.4"
query = '''
process where event.type == "start" and event.action == "exec" and process.name like~ "ledger live" and
process.code_signature.trusted == false
'''
min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[threat.technique.subtechnique]]
id = "T1036.005"
name = "Match Legitimate Resource Name or Location"
reference = "https://attack.mitre.org/techniques/T1036/005/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "8.11.0"
Stages and Predicates
Stage 1: process
process where event.type == "start" and event.action == "exec" and process.name like~ "ledger live" and
process.code_signature.trusted == false
Indicators
These rows show field, operator, and value matches.