Aoki (Aokigahara): AI Coding Assistant Credential Stealer

Aoki, also written Aokigahara and detected by Symantec as Infostealer.Aoki, is a Windows infostealer whose newest builds add an aisessions module that takes credential, session and configuration files of AI coding assistants and cloud CLIs. Built on the Symantec and Check Point Research reports. Delivery vector and operators are not established.
Threat
Aoki (aka Aokigahara; Symantec: Infostealer.Aoki)
Severity
HIGH · CREDENTIAL AND SESSION THEFT
Type
Windows infostealer, no backdoor command set
Access Vector
Not established in the reporting
Version
v0.1 (Draft) · 2026-10-27
Author
HuntPack
Confidence
High on capability and indicators (two independent vendors); delivery, operators and monetisation unknown
01

Executive Summary

Attacker objective. Aoki (also written Aokigahara; Symantec detects it as Infostealer.Aoki) is a Windows infostealer that collects whatever it finds on a victim machine and sends it to a command-and-control server. Its newest builds add a module Check Point calls aisessions that targets the credential, session and configuration files of AI coding assistants and the cloud credentials next to them: Claude Code and Claude Desktop, Codex, ChatGPT Desktop, Cursor, Windsurf, Kiro, GitHub Copilot, Gemini CLI, JetBrains AI Assistant, Amazon Q and AWS CLI and SSO caches. [#1] [#2]

Why it matters. A stolen API key or session token acts under the developer's identity and quota, and can expose the repositories, cloud services and CI/CD pipelines tied to that account. Symantec calls the quota-abuse case LLMjacking. Check Point adds that conversation histories and uploaded files could be used for extortion, and that it could not confirm how the operators monetise the data. The rest of the target list (more than 40 browser families, about 70 wallet extensions, about 20 desktop wallets, Discord, Telegram, game clients, password managers, FTP and VPN clients, Outlook and Thunderbird) points to a financial motive. [#1] [#2]

What is not known. The initial delivery vector is not established in either report, so this pack does not assume one. Symantec states that it does not know which group is behind the malware. Neither report attributes it. There is no backdoor command set: the stealer collects, packages and uploads, then cleans up locally. [#1] [#2]

Highest-value defensive angle. Detection of the stealer itself is thin: the C2 names and hashes are published, but new builds will not match them, and Falcon does not log most file reads. The reliable win is on the credential side: shorten the life of AI and cloud tokens, keep long-lived keys out of plaintext config files and .env, and be ready to revoke every AI, cloud, Git and browser session on any host that hits.

Defender priority. Any hit on Q1 to Q4 or Q7 is a credential-exposure incident, not a malware cleanup. Rotate AI provider keys and sessions, AWS keys and SSO sessions, Git tokens and browser sessions before or alongside reimaging. Cleaning the host leaves every stolen session valid.

02

Source Review & Web Hunter Notes

Two primary vendor sources were fetched and saved verbatim as text snapshots for the provenance gate. They are separate research teams working from their own samples, so a value that appears in both is independently corroborated. Searches for further primary vendor reporting found only secondary write-ups of these two reports; those were not cited and no indicator was taken from them.

#TierSourceKey findingCarry forward
1T1Symantec / Carbon Black Threat Hunter Team: Aoki infostealer targets AI coding assistant credentials (snapshot 01)Primary vendor report. Names the family and the Infostealer.Aoki detection, the AI-assistant files stolen, the long list of other targets, the /gate endpoint, and publishes 17 SHA-256 hashes and 3 C2 domains. States attribution is unknown and that older samples did not look for AI files.yes
2T1Check Point Research: Infostealer riding the AI Train, 2026-10-23 (snapshot 02)Independent primary report with its own sample analysis. Documents the handler table including aisessions and its target paths, the AES-256-CBC encrypted config in the .stgcfg section, X25519 key exchange and AES-256-GCM chunk upload to /gate/handshake, /gate/chunk and /gate/complete, the language-based execution guard, anti-analysis checks, and publishes 150 SHA-1 hashes, one clipper hash, 7 C2 domains and one raw IP with port 8080.yes

Decisions and discrepancies

  • Corroboration. Three C2 domains (dobeqnesmot[.]cc, hjazfioe[.]surf, neihite[.]cc) appear in both reports. Only those three are eligible for a prevent posture. The four other domains and the IP address come from Check Point alone and ship as detect. The two vendors publish different hash types (SHA-256 and SHA-1), so no individual hash is confirmed by both and all hashes ship as detect.
  • Names. This pack uses only the names the sources use: Aoki, Aokigahara and Infostealer.Aoki. Symantec says it has no indication of links to any existing malware family. Check Point says an earlier version may have been known as Kamidere or Stygian. That is Check Point's hedged statement, is not corroborated by Symantec, and is not used to merge this pack with any other family's indicators.
  • Dates. The saved Symantec page text carries no byline date, so this pack calls it an October 2026 report. Check Point is dated 2026-10-23 on its page.
  • Target lists differ. Symantec names Codeium and Gemini and lists wallets, browsers and clients in detail. Check Point gives exact file paths and adds Windsurf, Kiro, Amazon Q, Visual Studio Code, GitHub Copilot and Gemini CLI. Both lists are used; the union is the hunt surface.
  • Left out on purpose. Check Point's sample HTTP requests show per-build and per-session values (build id, gate token, session id, hardware id). These identify one sample or one run, not the family, so none of them is shipped as an indicator. Check Point's full YARA rule is not reproduced; its string anchors appear in the behavioral block in section 10.
  • Hostile content. None found. Neither page contained instructions directed at the reader.
03

Hunt Brief & Attack Chain

Seven hypotheses, ordered by fidelity. Telemetry is named in plain terms first, then by platform where the name is certain.

  1. H1 (high): an endpoint resolved or connected to Aoki C2 infrastructure (Q1, Q2). T1071.001, T1041. FP: none expected. DNS lookup with the requesting process (CrowdStrike: DnsRequest. SentinelOne: DNS Resolved. Defender: DeviceEvents DnsQueryResponse) and outbound connection (CrowdStrike: NetworkConnectIP4. SentinelOne: IP Connect. Defender: DeviceNetworkEvents).
  2. H2 (high): a published Aoki sample ran or was written to disk (Q3, Q4). T1204.002. FP: none expected. Process creation with hash (CrowdStrike: ProcessRollup2. SentinelOne: Process Creation. Defender: DeviceProcessEvents) and executable write (CrowdStrike: PeFileWritten, NewExecutableWritten. SentinelOne: File Creation. Defender: DeviceFileEvents).
  3. H3 (medium): one process opened files from three or more AI-assistant or cloud-credential families (Q5). T1552.001, T1528, T1539. FP: backup, indexing and DLP agents. File open on a named path (CrowdStrike: FileOpenInfo, sensor and policy dependent; no confirmed equivalent named here for the other platforms).
  4. H4 (medium): the clipper component was dropped under a volume-root Microsoft\Vault folder (Q7). T1115. FP: near none. Executable write and process creation as in H2.
  5. H5 (low): an older build sent cleartext HTTP to a raw IP on port 8080 (Q6). T1071.001. FP: developer tools. Process creation joined to outbound connection.
  6. H6 (native): proxy or firewall logs show a POST to /gate/handshake, /gate/chunk or /gate/complete with user agent Microsoft-CryptoAPI/10.0 to a host that is not a Microsoft service (N1). Outside endpoint telemetry.
  7. H7 (native): stolen credentials are being used: AWS, AI provider, Git and identity-provider sessions from new addresses (N4 to N6). Outside endpoint telemetry.

Attack chain

StepTelemetryHunt angle
1 · Initial deliveryNot established in either report. No telemetry can be named honestly.Gap. After any hit, pivot from the sample's parent process, download source and first-seen time (pivot P1 in section 9) to find the delivery path.
2 · Execution and guardsProcess creation with command line, path and hash (CrowdStrike: ProcessRollup2. SentinelOne: Process Creation. Defender: DeviceProcessEvents)H2 (Q3, Q4). The language guard stops the run on Russian, Ukrainian and other CIS-region language or keyboard settings, so a sample may start and exit quietly on such hosts.
3 · Config decrypt and module selectIn-memory. Outside endpoint telemetry.Static only: a .stgcfg PE section with the STGC magic (retro scan, N7).
4 · Collection (aisessions, ide, browsers, wallets and the rest)File open on a named path (CrowdStrike: FileOpenInfo, sensor and policy dependent)H3 (Q5). Reads of browser stores and wallet folders by one process are the same shape; extend Q5 with those paths after baselining.
5 · StagingLocal temp database and in-memory ZIP. Mostly outside endpoint telemetry.Sysmon file create for a kmd_w_*.db name in a profile temp folder (N3).
6 · Upload to C2DNS lookup, outbound connection, proxy logH1 (Q1, Q2), H5 (Q6), H6 (N1). Upload is a handshake, one or more encrypted chunks, then a completion call.
7 · Clipper drop (module seen in Check Point analysis)Executable write and process creation under a root-level folderH4 (Q7).
8 · Abuse of stolen credentialsCloud, AI provider, Git and identity-provider logs. Outside endpoint telemetry.H7 (N4 to N6). This is where the loss happens.
04

Consolidated IOC Table

Prevent is limited to the three domains both vendors publish. Everything else is single-sourced and ships as detect or hunt. The credential files the stealer reads belong to legitimate applications; they are hunt surface, never indicators, and nothing in this table is a block on them. No IPv4 row is a version number: the one address is copied from the Check Point IOC list.

TypeValueConfidenceActionContext
Domaindfwioeiofwr[.]infomediumdetectC2 host named by Check Point only. [#2]
Domaindobeqnesmot[.]cchighpreventC2 host named by both reports. [#1] [#2]
Domaingate[.]dfwioeiofwr[.]infomediumdetectC2 host named by Check Point only. [#2]
Domainhjazfioe[.]surfhighpreventC2 host named by both reports. [#1] [#2]
Domainkkeyyou[.]ccmediumdetectC2 host named by Check Point only. [#2]
Domainneihite[.]cchighpreventC2 host named by both reports. [#1] [#2]
Domainsomelitersofblood[.]pwmediumdetectC2 host named by Check Point only. [#2]
URLhxxps://dobeqnesmot[.]cc/gatehighdetectUpload endpoint form published by Symantec; the same /gate path is documented by Check Point. Not importable as a URL IOC in Falcon; use the domain row. [#1] [#2]
IPv4 and port2[.]26[.]252[.]48 port 8080mediumdetectRaw-IP C2 over cleartext HTTP in older samples. Check Point publishes the address; Symantec describes the pattern (IP and port 8080) without the value, so the address is single-sourced. [#2] [#1]
SHA-25617 values, section 10 block grab-sha256highdetectInfostealer.Aoki samples. Single-sourced. [#1]
SHA-1150 values, section 10 block grab-sha1highdetectAokigahara samples. Single-sourced. Not importable to Falcon IOC Management; used by Q4. [#2]
SHA-1 (clipper)8d6c86e0af7807f9b5baf15e9f076bb81e012515mediumdetectClipper component dropped by the clipper_drop handler. Single-sourced. [#2]
HTTP request shapePOST /gate/handshake, /gate/chunk, /gate/complete; header names X-Chunk, X-Chunk-Index, X-Build-ID, X-Gate-Token, X-HWID, X-KEXhighhuntProxy or TLS-inspection logs only. [#2]
User agentMicrosoft-CryptoAPI/10.0lowhuntLatest analysed builds use this string. Also sent by legitimate Windows components to Microsoft hosts, so it only means something against a non-Microsoft destination. Older builds used different strings. [#2]
Named pipe\\.\pipe\akg_<hex>_<hex>mediumhuntString from Check Point's YARA rule. Sysmon pipe events only. [#2]
File namekmd_w_<n>_<n>.db in a profile foldermediumhuntString from Check Point's YARA rule. [#2]
PathC:\Microsoft\Vault\mediumhuntClipper drop location. Q7. [#2]
PE section.stgcfg with magic STGCmediumhuntEncrypted config blob. Static scan only. [#2]
Archive entry namesAISessions/, Screenshot.jpg, Clipboard.txt, Messengers/Discord/Tokens.txtlowenrichNames inside the encrypted upload; useful only if you hold a decrypted archive. [#2]
05

Affected Surface & Telemetry Matrix

SurfaceTelemetryPriorityGap risk
Windows developer and engineering workstations running AI coding tools and cloud CLIsProcess creation with command line, path and hash (CrowdStrike: ProcessRollup2. SentinelOne: Process Creation. Defender: DeviceProcessEvents); executable write (CrowdStrike: PeFileWritten, NewExecutableWritten. SentinelOne: File Creation. Defender: DeviceFileEvents)CriticalDelivery is unknown, so there is no early-stage detection. A new build will not match any published hash.
Credential and token files of AI assistants, Git, cloud CLIs and browsers (Claude, Codex, ChatGPT Desktop, Cursor, Windsurf, Kiro, Copilot, Gemini, JetBrains AI, Amazon Q, AWS)File open on a named path (CrowdStrike: FileOpenInfo, sensor and policy dependent)HighMost sensors do not log ordinary file reads. Zero rows can mean no telemetry, not no theft. Prove the event arrives (section 11) before trusting Q5.
Outbound C2 and exfiltrationDNS lookup with requesting process (CrowdStrike: DnsRequest. SentinelOne: DNS Resolved. Defender: DeviceEvents DnsQueryResponse); outbound connection (CrowdStrike: NetworkConnectIP4. SentinelOne: IP Connect. Defender: DeviceNetworkEvents); proxy and DNS server logsHighUploads are encrypted HTTPS POSTs to a handful of domains; without TLS inspection only the domain and volume are visible. Hosts without a sensor are only seen by DNS server or proxy logs.
Cloud, AI provider, Git and identity-provider accounts whose tokens were on the hostAWS CloudTrail, provider audit and usage logs, GitHub audit log, identity-provider sign-in logsCriticalOutside endpoint telemetry. Provider logging differs and some providers expose little. Spend alerts are the fallback.
Browser profiles, wallets, messengers, password managersSame file-open telemetry as above; browser and wallet reads are not queried in this packMediumCoverage gap by design: these folders are opened by their owner constantly, so a query needs a per-environment baseline first.
06

ATT&CK Mapping

TacticTechniqueObserved behaviorQuery or control
Credential AccessT1552.001 Unsecured Credentials: Credentials in FilesReads .claude.json, .codex\auth.json, .codex\.env, .aws\credentials, Gemini and Copilot config files, Cursor and Windsurf state databasesQ5; Hardening T1, T3, T7
Credential AccessT1552.004 Unsecured Credentials: Private KeysCollects files under .ssh that may hold private keys (Check Point ide handler)Q5 (extend); Hardening T1
Credential AccessT1528 Steal Application Access TokenAI-assistant and cloud tokens, Discord tokensQ5; N4 to N6; Hardening T3, T7
Credential AccessT1539 Steal Web Session CookieClaude and ChatGPT cookies, browser cookies, Roblox cookieQ5 (extend); Hardening T4
Credential AccessT1555.003 Credentials from Web BrowsersSaved logins, cards, autofill, Google tokens from Chromium and Firefox familiesHardening T4
Credential AccessT1555.004 Windows Credential ManagerThe aisessions handler also queries Windows Credential ManagerHardening T1
Credential AccessT1555.005 Password ManagersKeePass, Bitwarden, 1Password, Dashlane, RoboForm, NordPass, Sticky Password data and configHardening T4; N5
CollectionT1005 Data from Local System; T1119 Automated CollectionModule bitmask selects handlers; filegrabber reads Desktop, Documents, DownloadsQ5; Q3, Q4
CollectionT1113 Screen Capture; T1115 Clipboard DataScreenshot.jpg, Clipboard.txt, and a dropped clipper componentQ7
CollectionT1560 Archive Collected DataCollected data is packed into ZIP archives before uploadQ1, Q2 (upload)
Command and ControlT1071.001 Application Layer Protocol: Web ProtocolsPOST to /gate/handshake, /gate/chunk, /gate/complete over HTTPS; older builds cleartext to a raw IP on 8080Q1, Q2, Q6; N1, N2
Command and ControlT1573.001 Encrypted Channel: Symmetric CryptographyX25519 key exchange, key derived with SHA-256, AES-256-GCM chunksN1 (volume and shape only)
ExfiltrationT1041 Exfiltration Over C2 ChannelCollected archives uploaded in chunks to the same serverQ1, Q2, Q6
Defense EvasionT1480 Execution Guardrails; T1614.001 System Language DiscoveryWhen the config flag is on, stops if the keyboard layout or UI language matches a listed CIS-region languageGap: runtime check, no telemetry
Defense EvasionT1497 Virtualization/Sandbox Evasion; T1622 Debugger Evasion; T1027.007 Dynamic API ResolutionPEB, debug port, hardware breakpoint, CPUID and VM-artifact checks; API calls resolved by hash; control-flow flatteningGap: in-process, no telemetry
Defense EvasionT1036.005 Match Legitimate Name or LocationClipper placed under a Microsoft\Vault folder at the volume rootQ7
DiscoveryT1082 System Information Discovery; T1518.001 Security Software Discovery; T1057 Process DiscoveryThe sysinfo handler records OS, hardware, language, processes, installed software and detected antivirusGap: in-process
Initial AccessNot establishedNeither report identifies how the stealer reaches a hostGap, stated openly
07

Native Audit-Log Hunts

IDSourceWhat to look forPass condition
N1Proxy, firewall or TLS-inspection logsPOST requests to a path ending /gate/handshake, /gate/chunk or /gate/complete; request headers X-Chunk, X-Chunk-Index or X-Gate-Token; user agent Microsoft-CryptoAPI/10.0 sent to a non-Microsoft host; a run of POSTs to one host ending in a small POST with an 8-byte body. Last 90 days.No match to a non-Microsoft destination. Any match: identify the source host and run the containment runbook.
N2DNS server, resolver or secure DNS gateway logsQueries for the 7 C2 names and their subdomains, from hosts that the sensor does not cover (servers, unmanaged laptops, VDI). Last 90 days.No query. Any hit: treat the querying host as exposed.
N3Windows Sysmon (event 1 process create, 11 file create, 17 and 18 pipe created and connected)A pipe name starting akg_; a file named kmd_w_ plus two numbers and .db in a profile temp folder; any file created under a volume-root Microsoft\Vault folder.No match.
N4AWS CloudTrail and IAM credential reportFor every access key and SSO session that was on a hit host: API calls from addresses outside your normal ranges, GetCallerIdentity or ListBuckets style reconnaissance from a new address, new access keys, new IAM users or roles, console logins. Use the key id, not the user name.No use from an unexpected address between the first possible infection and revocation.
N5AI provider consoles, GitHub audit log, JetBrains and Cursor account pagesNew API keys, unexpected usage or billing spikes (the LLMjacking pattern Symantec names), sessions from unfamiliar devices, new OAuth app grants, repository clones or token use from new addresses. Check every provider the host had a signed-in tool for.No unexplained key, session, usage spike or clone. Revoke anything unexplained.
N6Identity-provider and SaaS sign-in logsSign-ins for users on hit hosts from a new device or address that reuse an existing session without a fresh MFA prompt (cookie replay), including browser-based AI and developer tools.No replayed session. Any hit: revoke all sessions for that user.
N7Retrospective file scan (YARA or EDR file search)PE files with the .stgcfg section, or with the strings X-Chunk-Index: %u, AKGRES, AISessions/, aokigahara and /chunk (string anchors from Check Point's published rule; take the full rule from the source).No match across developer workstation images and download folders.
08

Hunt Queries: CrowdStrike CQL, SentinelOne PowerQuery and Defender XDR KQL

Show all queries in
Pick your tenant's cloud first: every "Open in Falcon" button below uses this selection.
Q1 · Aoki C2 domain resolution
CONF HIGHFP LOWCOST LOW

Looks for: a DNS lookup of any of the 7 Aoki C2 names, or a subdomain of them. Three names are published by both Symantec and Check Point; four come from Check Point only. The requesting process is collected so the next step is a process pivot.

Validation: schema-aligned, static-reviewedAutomated: static-passedEquivalence: equivalent-with-schema-assumptionsProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
  • PowerQuery: DNS answers served from a resolver the agent does not observe are not captured.
  • PowerQuery: Name resolution inside a process the agent did not instrument is not captured.
  • PowerQuery assumes: The queried name is in event.dns.request on this tenant; some schema versions use dns.request.
  • PowerQuery assumes: Substring matching also matches a longer name that merely ends with or embeds one of the listed names.
  • KQL – Defender XDR: The CQL counts lookups per host and name; this lists the individual response rows instead.
  • KQL – Defender XDR assumes: DnsQueryResponse rows carry the queried name under DnsQueryString or QueryName in AdditionalFields.
  • KQL – Defender XDR assumes: The DnsQueryResponse action type is attested in Microsoft-owned hunting repositories rather than on the Learn table page.
// HUNT: Aoki C2 domain resolution
// MITRE: T1071.001, T1041
// CONF: high  FP: low  COST: low | REQUIRES: DnsRequest (DomainName, ContextProcessId)
// FALSE POSITIVES: none expected for the names. Malware sandboxes and research hosts that detonate samples will also resolve them.
// LOOKBACK: 30d (set in the time picker)
#event_simpleName=DnsRequest
| DomainName=/(^|\.)(dfwioeiofwr\.info|dobeqnesmot\.cc|gate\.dfwioeiofwr\.info|hjazfioe\.surf|kkeyyou\.cc|neihite\.cc|somelitersofblood\.pw)$/i
| groupBy([aid, ComputerName, DomainName], function=[count(as=Lookups), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen), collect(ContextProcessId, limit=10)], limit=1000)
| sort(LastSeen, order=desc, limit=1000)
Q2 · Aoki C2 raw-IP connection (older builds)
CONF HIGHFP LOWCOST LOW

Looks for: an outbound connection to the one address Check Point lists as an Aoki C2. Symantec says older samples used an IP address on port 8080 over unencrypted HTTP but does not publish the address, so this value is single-sourced and ships as detect.

Validation: schema-aligned, static-reviewedAutomated: static-passedEquivalence: equivalent-with-schema-assumptionsProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
  • PowerQuery: Connections made before the agent was installed, or beyond the tenant's data retention, are not captured.
  • PowerQuery assumes: Outbound connections are recorded as IP Connect events with the remote side in dst.ip.address.
  • PowerQuery assumes: The acting process on a non-creation event is src.process.*.
  • KQL – Defender XDR: Advanced Hunting keeps 30 days, so connections between 30 and 90 days old are visible only on the CQL tab.
  • KQL – Defender XDR assumes: RemoteIP holds the destination address for outbound connections.
// HUNT: Aoki C2 raw-IP connection
// MITRE: T1071.001, T1041
// CONF: high  FP: low  COST: low | REQUIRES: NetworkConnectIP4 (RemoteAddressIP4, RemotePort)
// FALSE POSITIVES: none expected. Address reuse after the actor abandons it is possible; check the first-seen date against the report.
// LOOKBACK: 90d (set in the time picker)
#event_simpleName=NetworkConnectIP4
| RemoteAddressIP4="2.26.252.48"
| groupBy([aid, ComputerName, RemoteAddressIP4, RemotePort], function=[count(as=Connections), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen), collect(ContextProcessId, limit=10)], limit=1000)
| sort(LastSeen, order=desc, limit=1000)
Q3 · Known Aoki sample hash (SHA-256, Symantec)
CONF HIGHFP LOWCOST LOW

Looks for: a process start or an executable write whose SHA-256 is one of the 17 Symantec-published Infostealer.Aoki hashes. A hash only names a build; new builds will not match, so a miss is not a clean result.

Validation: schema-aligned, static-reviewedAutomated: static-passedEquivalence: equivalent-with-schema-assumptions, telemetry-gapProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
  • PowerQuery: A file the agent never hashed is not matched.
  • PowerQuery: Samples repacked after the report have different hashes and are not matched.
  • PowerQuery assumes: The SHA-256 is populated on process-creation and file events on this tenant.
  • PowerQuery assumes: Hash matching is case-insensitive here because the agent may store hashes in either case.
  • KQL – Defender XDR: Written files are not covered; DeviceFileEvents holds those and a single query cannot span two tables.
  • KQL – Defender XDR: Advanced Hunting keeps 30 days, so older executions are visible only on the CQL tab.
  • KQL – Defender XDR: A sample that is written but never executed is not matched.
  • KQL – Defender XDR assumes: SHA256 is populated on the process-creation rows of this tenant; Microsoft documents it as often empty.
// HUNT: Known Aoki SHA-256 executed or written
// MITRE: T1204.002, T1059
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2, PeFileWritten, NewExecutableWritten (SHA256HashData)
// FALSE POSITIVES: none expected. Malware-analysis repositories and sandbox hosts will hold the samples.
// LOOKBACK: 90d (set in the time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| in(field=SHA256HashData, values=[
    "752c8e64af60960b85cf00e4bd34eb459e24b7939464f718ec18494df43b4b69",
    "bf037920d39b85572ec7e53b51f09c28198c2c0afbc7c7d6cf639b1f047caebf",
    "0adc8e83b2416c275b1283916d70568faddeb6d718eb45f9addfb0938db245b3",
    "6655b89b9885483d459c73f2a52e3cec121de5c5956172a8676a0f4c2de94999",
    "780bbdbb119befd4eb16e0c2ec0c64e7bedc1b53ce4f85804aea091a6e3af519",
    "2fb80e2221bd304e7cd5ac04169e71807ad92d19836f1aaf7885295cb90b2d94",
    "73dbac0907e8a092cd978f2787ab1994946f5da1e08f2bdbd05ea52e80cdb896",
    "07bc2e3a1d14743cc44f1dc4c78d15d0f2b458b39fb48422b13df40fc662ba21",
    "c533570fd7cd7eaf5478317b03ea5750d03797aa4d11ebd96555b6cb708c63f2",
    "6350dfee6975a9b159c5a57a3e97f757b0b02fd2dc708016fa6d7270e720c865",
    "36af3acc78058023cdcf9307bc15be640be9425de97e574fdaf42d03d308725b",
    "039240551f88b0064b2615dffdc1321b1e7c58e3f617ac138a65a6d59400b331",
    "0e38bd3c30a4ca08641240ce95b5b6ba593e131213ca1b2a28da4e0385fcabc4",
    "3b4547f0d7549274f366cd9568b3d302c1e80e1b89359da681beb47260ec7975",
    "b590235493487c51f7050b341c9b2450e4f761ad6055207e4f6daf0cecae271c",
    "e374f9ff5094f728528efa566c3de1b7fea7d95f497242a01fffa6c70b5eb768",
    "f779314b1a5a0b297fd4e2a5f9c1e40d387b3e7c401d42324b556a70f813840e"
  ])
| table([@timestamp, aid, ComputerName, UserName, FileName, FilePath, SHA256HashData], limit=200)
Q4 · Known Aoki sample hash (SHA-1, Check Point)
CONF HIGHFP LOWCOST MEDIUM

Looks for: a process start or an executable write whose SHA-1 is one of the 151 Check Point-published Aokigahara hashes plus the one clipper component hash. Falcon IOC Management does not take SHA-1, so this query is how those hashes are used on the endpoint. The two vendors publish different hash types, so no hash is confirmed by both.

Validation: schema-aligned, static-reviewedAutomated: static-passedEquivalence: equivalent-with-schema-assumptions, telemetry-gapProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
  • PowerQuery: A file the agent never hashed is not matched.
  • PowerQuery: Samples repacked after the report have different hashes and are not matched.
  • PowerQuery assumes: The SHA-1 is populated on process-creation and file events on this tenant.
  • PowerQuery assumes: Hash matching is case-insensitive here because the agent may store hashes in either case.
  • KQL – Defender XDR: Written files are not covered; DeviceFileEvents holds those and a single query cannot span two tables.
  • KQL – Defender XDR: Advanced Hunting keeps 30 days, so older executions are visible only on the CQL tab.
  • KQL – Defender XDR: A sample that is written but never executed is not matched.
  • KQL – Defender XDR assumes: SHA1 is populated on the process-creation rows of this tenant.
// HUNT: Known Aoki SHA-1 executed or written
// MITRE: T1204.002, T1059
// CONF: high  FP: low  COST: medium | REQUIRES: ProcessRollup2, PeFileWritten, NewExecutableWritten (SHA1HashData)
// FALSE POSITIVES: none expected. Malware-analysis repositories and sandbox hosts will hold the samples.
// LOOKBACK: 90d (set in the time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| in(field=SHA1HashData, values=[
    "007137599bc4d69ee952a5228b5fcb2c3b9a95a7", "00d52c7e759d878f0d8a117502f6d854af13f007", "04eddccb79db41e03a4ee8542e8a33d7f1d9fe18",
    "057a2d1dedeb93b7765c455a9e0c469e7cbe4843", "079ddf5cc7d6ca2e02f860f87d4d18c83db9d331", "0b74ce90a39278fb97fe94f6306af71cbe679503",
    "0c46ac5555cf8f305c1345a21d0802c52bf52cd8", "0d8d0bad2e08856ba379e425e2e90e49506af631", "0e76150cee3f2b89f0fbe39106ab2898db109f09",
    "0f69792cb926a416766d47a30a05009c13be0d64", "130f2710cf9863bdd6724e8912600505b6fb7ef2", "133dc00ad81638e6b0a2f8f163b4d694ce477165",
    "151d8013ca3ab3dab9cd37f4ed9870cc83e87a77", "1701db4fa798b309cb25227408406dde4c69de8a", "1835f1e0b1eda3dc4b39682ecad3eba88cbbc44e",
    "18e041b5a0c668392ff4d036f3f9660c2698311e", "1a6a6e08a01cc3f1455af2c4ecd59a3d7802cd7a", "1a7248720f3ac79082841b006582f20799b314a9",
    "1a97a18db74f2b6df984c9a188a79b4e65a06b81", "1cb6ccfdcb277a0277729443d15f17a441fa0eda", "1cb8dc11bdb8baf342b83079fb650cd6bb1b132d",
    "1e072236f87cd914dc583ca2163460d656bfcfba", "1e94d7f1d501724076fcf98459e14b68321d45f7", "2045f165d737f2d43ba603d444dfa5d9e6f05805",
    "211e45f306b84a82cfe736635c176a424e7479dc", "21ef070e39f651118a804882374dc2dfa3e38666", "2362a326070d83c167251873b389bd783781cf6c",
    "241e37b8fc5ffeefbd1d89a82b74cf2d92b49eac", "244371fc1642f0548b807b0a4a2e7ea5d7b4c82a", "28099fc5a8cbbd40173f8ac0aded9044fdb4a598",
    "2cdc77108c585d14b1567053b8f8a58ea78c255f", "2f30b116ca3dc48ff5783c3bb7391d671866e27b", "30737fa46f2ff93e33f45008cf306233954ea898",
    "324e0fffc7977f8ff591993819123d33c2970953", "3586eeaf3ffe2c3a4f1d005aee863b7aee7cc7bd", "3696baa239c479f9f5103618214972890f1a473b",
    "385e21a96687a33f79f9cab0627aec7218e1a8f4", "38b2c29b46086b417181deb958e8b276a9d1fbf4", "3aaeb49864108c92af50feeb5d9e3b3efaa39818",
    "3c56a0c3c59a1425bfdcdffda9e8b308f478b147", "426bea548a24f7f39c279770b5dd21fbed7f7328", "4417d2645adb6e7e94959daf483f93058500840f",
    "4485feb1385975ef13f08148cdc679f50fa0cc6d", "456414c0acf463e06f95f5bd3d8355758fca6b53", "4595d1875441ffb8c076856e366d1f4f5c74a679",
    "48c6b66dc4b4d40d72b7460e6fd670b6c03d5d40", "4b3a4ad0acd43fc8796147381074a98e8e576904", "4c07021f8b0cdd3ca334a13f9af2bade9e699dc2",
    "50060c0fc5fa8932671eb24b03b05d00c2e99951", "51ae6cad54f33846f83a352457b9a44ef8b7a61d", "59bbaca8a848215e7e4af7cec320432c51b0b812",
    "5ef7eb755f1e3f6bf8586794777466a639057dcb", "5fadf206dc163f63ebf66f984042b00c67121813", "5fe11fbb89d33efa712ffb8590626bd88fecab8f",
    "61a024f5a42a9a91b0a9871a1613c7fb3ef5613b", "62dcc9ba2a5eee9dd941ad08766603c89a45869b", "6393c0d3fb76f771a9418c2d152c621929ee002b",
    "63cc5033532cd00bda3d4968b1257629e613505a", "682dd6392004e1131b1aa3f2351a0bc7adb84d14", "699c809a116106da40b3f641c11b0db34d0f1c5e",
    "6a09fffca381f6624d2def1083284ca486306e7c", "6c860007f8f49de8e9848b538bd7acdc6bfcdf55", "6e073a196a9bfa01da418b5783c2395fb22c7ec9",
    "6eb8f17dba69f6d25b7f5c529b25d199707b69e2", "6f7d5935602c188b1e3066b4ab9aeef7b85a8ec2", "70915fac07af4ad7acc1868fe05dc00b98206f0f",
    "70d4007b11e56752fffb81f71c90987f4bb441fa", "70e91644802053cfa68be6ec0f94207282ff27e4", "7233a15327dc2f0cca0292e6352eebf6e6e090d8",
    "72aa6417a19c45dabdd6c79087fb13c73ae7b823", "7cc6c75fad93b2482a9c5f4522530007c72f99e0", "82ebfc09c98bd211ff8b08efcd8ec8b9ce1fb4be",
    "83b43ce0ee9881201451c0604fb5b792bd4581f5", "86230c07e638b85bc8010df1aa9e33ca61fda4cc", "89f296aef7988bdd59109e4263d0a31c886770aa",
    "8b0cf62382f620bbbf5d176295d63ed522ab9c2c", "8c3111a61fbf30e86b8206397ce3c0017e5ea509", "8c4c1d8325adb463c34694ce3a5a851e97b81a6f",
    "8d7a81119ce7be6eb452192f08fa2669228ff597", "8d860ca64ce0cbf40871fd66b9e3a513e73cda90", "8dc40b7208b8c0d95d1ab8dda9a56fff790b3ddd",
    "8e9fd1274b77ff9726c4637d008a9d599c9d5f1e", "9003310bf73dc337b8b50131f1c0724a79161aac", "90c057dafefbee423e3014266218272d454a0aa3",
    "912ed8ce7767f94f62de6a30fb8e9df7c0c512f7", "9369e0e5eae22cff71b375ad285ea89471f25101", "97c80e2d382e6e55f61702da3afb838fdec2f4f1",
    "98c6649cc256dfadf1af939da46f037b05c0f2e5", "99b28a20851a3ed29769a469f4dd31ebbb8a83de", "9d424ce23753ffddc7b39477222123b0f2c33066",
    "9f05045f5447d79c8c0d0f5cb589fd85c89620d3", "9f20034441e78574aec7ad39842a342f939eaf6a", "a00da33342a5ea5168d851a5c93109e07cf95c49",
    "a2abdf1af38da9995a3b6672ce6c34e9e17c39a4", "a4871f4a61faf74e1cceaffe26901f6076c9f37e", "a63ded811d412cd0f859891b0c1f066b87bb1b80",
    "a84148b4d408544325c20ee04299ae95c762b6a2", "ad960d2abb1999a7260c5f498532a5bb8754c2a5", "ae9d6b1a32a45b05edb920538e538a3d6a5fe439",
    "af196456d2ebf9556ab239661922565e1bca9ac0", "b335483800d35a29c25767c917725e24c21b0f2b", "b33e59c598845d2547ddc7f654115df2284bb3ae",
    "b36d0796e33f808eaeb33b33908327a410680c56", "b4491f1919a88deedebe7fba56b593e7d6655458", "b523d56d82485253f2e3619437c8398b7ee0f20d",
    "b607025d3e06d1e8cffcd398c64871d7fcd92bf4", "b6f0dfd3aa2fc7b8b2ad432c4a4276da23ceb46b", "bab4c910e3c98085bf228519f346d071a75e44e3",
    "bad339c5ad65808285b0e87498f2ea6f669417d9", "c00aceaa40b38e48f662ac927bb86302934aaf96", "c2e28ba5523c1f3a545a0b4a00a9d5e9c8ae7583",
    "c323c59815082ac842f0bafcc01f537444e1cc5a", "c5b50b5e14dfb5e028dfd88a4e4fb960dd650b52", "c810acdf30bcdfc6e8021e7f62a3bcce0828c2ee",
    "c8456bb71a74ed6305455c318295b8a39e9277f3", "cbdff0df0dbdbc3c1845d208661dd75fd335ef93", "cc12fcb9e5e6f7afde66f5c3452ed6e3cd6d5390",
    "cc708ae3d7aa084279122c0db7250096f750d6b0", "d34491da5aa159314129c0ff67f957d873703e35", "d3c90275dd7279a791d717676be15789376f7aa7",
    "d8bfff5139b54b6f98f07c051cd25d7aa465fec8", "da986a3cb2ce67456ef374fbdd957d370a1a4367", "daef439e1f110d624ce50fe0f9d9d24f61f7497b",
    "db3332ce75676389b79cf3603d81cb231cb7c19c", "db69c7c930fd5dc5097847979a965fdea4171d5b", "dba5fef27b53ff479a4d7046cd1f22710081a16c",
    "de9d152010819c8fb5cb611a4de920399e69cfeb", "dfd1540c0185e74ec65acfcae1af7ba0da36c774", "e052ff49190f54e0ffc52f7b3f7b5e7b9e121c4c",
    "e3af6d9e3b35e5e04feda3cde96256dd3b099624", "e4d93fa1b2d0fd26e8b877511ea33badb4628169", "e5c43abd1c212b2f2a61d5e1cb7821406ca5dc8e",
    "e8d09eb2e5857fde39b44aeb48078f5396809026", "ec7cd90d56e5b73caa9d4eb0472bfee68d716121", "eec7ece53d47e50940584f4dec684a24a78f42f2",
    "f0b23f420659babb3a730b122259440091c53c12", "f30e9730db0663f87c67a4b9a0cf12ee59b1621a", "f35e6d2936c0f6dc26bdc68f6d1599cf438a863a",
    "f4184e1bb61e19d190555c50fdb9d4591767bf53", "f47d45eea1c42b066f8537baf72ffa266646bf62", "f5993e64a18e7494b25a185de9f63a1df961b99a",
    "f633fc9fd16dadca2725d3d54aaf13ea1a62174f", "f6d950a5a8e5ba336f748b66745c6c1f189d3362", "f8cf33b18e9932d285696fee40a7fee2a87341c2",
    "f8dbc552c89bef758e4fcbd9942d06bc0c11db0a", "f990bf4f05dfa4d86b3e3bc0a54f62e91b83f2c6", "fa61cf3bebefd88ea9d06007a4b85791aa851c8a",
    "fbe8708247fabd8a1bc3963db3911b5e77728669", "fe6b7d6fa8c2424d14a0d465ab78aaf83db0d07b", "ff402e64bc42222c8a4ee703123903c2a2117dd9",
    "8d6c86e0af7807f9b5baf15e9f076bb81e012515"
  ])
| table([@timestamp, aid, ComputerName, UserName, FileName, FilePath, SHA1HashData], limit=200)
Q5 · One process opening several AI-assistant and cloud credential stores
CONF MEDIUMFP MEDIUMCOST MEDIUM

Looks for: a single process that opens files from three or more different AI-assistant or cloud-credential families (Claude, Codex, ChatGPT Desktop, Cursor, Windsurf, Kiro, Copilot, Gemini, Codeium, Amazon Q, JetBrains AI, AWS) inside the search window. This is the closest endpoint signal to the aisessions module, which sweeps all of them in one pass. FP: backup agents, file-indexing and DLP scanners and profile-migration tools touch many user folders; baseline them and exclude by image name. Caveat: the file-open event is sensor and policy dependent. Zero rows is not a clean result until you have confirmed the event arrives from a test host (readiness test in section 11).

Validation: static-reviewedEquivalence: unsupported-without-redesignProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
  • PowerQuery: Reads of credential stores by a process are not visible in SentinelOne; File Creation and File Modification events show only writes.
  • KQL – Defender XDR: Reads of credential stores by a process are not visible in DeviceFileEvents.
// HUNT: Multi-family AI credential store access by one process
// MITRE: T1552.001, T1528, T1539, T1005
// CONF: medium  FP: medium  COST: medium | REQUIRES: FileOpenInfo (TargetFileName, ContextProcessId); sensor and policy dependent, validate in tenant
// FALSE POSITIVES: backup agents, EDR and AV scanners, desktop search indexers, DLP agents, profile migration tools
// TUNING: after a 14-day baseline, resolve the process with the pivot in section 9 and exclude known scanner and backup image names; raise the family threshold only after reviewing what sits at 3
// LOOKBACK: 14d (set in the time picker)
#event_simpleName=FileOpenInfo
| TargetFileName=/(\\\.claude(\.json|\\credentials\.json)|\\Claude\\|\\\.codex\\|\\OpenAI\.ChatGPT-Desktop_|\\(Cursor|Windsurf)( - Insiders| - Next)?\\User\\globalStorage\\|\\Kiro\\User\\globalStorage\\|\\\.copilot\\|\\\.gemini|gemini-cli-workspace|\\\.codeium\\|\\amazon-q\\data\.sqlite3|AIAssistantQuotaManager2\.xml|\\\.aws\\(credentials|sso\\cache\\))/i
| case {
    TargetFileName=/\\\.claude|\\Claude\\/i | Family := "claude";
    TargetFileName=/\\\.codex\\/i | Family := "codex";
    TargetFileName=/OpenAI\.ChatGPT-Desktop_/i | Family := "chatgpt";
    TargetFileName=/\\Cursor/i | Family := "cursor";
    TargetFileName=/\\Windsurf|\\\.codeium\\/i | Family := "windsurf-codeium";
    TargetFileName=/\\Kiro\\/i | Family := "kiro";
    TargetFileName=/\\\.copilot\\/i | Family := "copilot";
    TargetFileName=/\\\.gemini|gemini-cli-workspace/i | Family := "gemini";
    TargetFileName=/amazon-q/i | Family := "amazon-q";
    TargetFileName=/AIAssistantQuotaManager2/i | Family := "jetbrains-ai";
    * | Family := "aws";
  }
| groupBy([aid, ComputerName, ContextProcessId], function=[count(Family, distinct=true, as=Families), collect(Family, limit=20), collect(TargetFileName, limit=20), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=1000)
| test(Families >= 3)
| sort(Families, order=desc, limit=200)
Q6 · Cleartext HTTP on port 8080 to a public address from a user-writable path
CONF LOWFP MEDIUMCOST MEDIUM

Looks for: a process that started from a user profile, ProgramData or Windows Temp and connected to a public address on port 8080. Symantec says older Aoki samples used an IP address on port 8080 over unencrypted HTTP. Newer builds use HTTPS to named domains, so this is a coverage query for older builds, not for the current one. FP: developer tools, local proxies and some update agents use 8080; exclude by image name after a baseline.

Validation: schema-aligned, static-reviewedAutomated: static-passedEquivalence: approximate-analyticProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
  • PowerQuery: The CQL also requires a process-creation event for the same process in the window; this query does not.
  • PowerQuery: Loopback and link-local destinations are excluded by subnet tests rather than the CQL's pattern.
  • PowerQuery assumes: On an IP Connect event the acting process is src.process.*.
  • PowerQuery assumes: src.process.image.path holds a Windows path with drive letter and backslashes.
  • KQL – Defender XDR: The CQL also requires a process-creation event for the same process in the window; this query does not.
  • KQL – Defender XDR assumes: RemoteIPType is populated, and Public excludes private, loopback and link-local destinations.
  • KQL – Defender XDR assumes: InitiatingProcessFolderPath holds the full image path of the connecting process.
// HUNT: User-writable-path process connecting to a public address on 8080
// MITRE: T1071.001, T1041
// CONF: low  FP: medium  COST: medium | REQUIRES: ProcessRollup2, NetworkConnectIP4
// FALSE POSITIVES: developer tools, local proxy clients, software updaters that use port 8080
// TUNING: add the image names of approved developer tools and updaters to the FileName exclusion in the process clause after a 14-day baseline
// LOOKBACK: 14d (set in the time picker)
#event_simpleName=/^(ProcessRollup2|NetworkConnectIP4)$/
| coalesce([ContextProcessId, TargetProcessId], as=falconPID)
| selfJoinFilter(field=[aid, falconPID], where=[
    {#event_simpleName=ProcessRollup2 ImageFileName=/\\(Users|ProgramData)\\|\\Windows\\Temp\\/i FileName!=/^(chrome|msedge|firefox|brave|code|node|python|java|teams|slack)\.exe$/i},
    {#event_simpleName=NetworkConnectIP4 RemotePort=8080 RemoteAddressIP4!=/^(10\.|127\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.)/}
  ])
| groupBy([aid, falconPID], function=[collect(ComputerName, limit=1), collect(UserName, limit=5), collect(FileName, limit=5), collect(ImageFileName, limit=5), collect(RemoteAddressIP4, limit=10), min(@timestamp, as=FirstSeen)], limit=1000)
| sort(FirstSeen, order=desc, limit=200)
Q7 · Executable under a volume-root \Microsoft\Vault folder (clipper drop)
CONF MEDIUMFP LOWCOST LOW

Looks for: an executable written to, or a process started from, a Microsoft\Vault folder at the root of a volume. Check Point says the clipper_drop handler places a clipper component beneath C:\Microsoft\Vault. The real Windows credential vault lives under ProgramData and under each profile, so a root-level folder is unusual. The anchor on the volume root is what keeps this low-noise.

Validation: schema-aligned, static-reviewedAutomated: static-passedEquivalence: equivalent-with-schema-assumptions, telemetry-gapProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
  • PowerQuery: A file written through a path the agent reports without a drive letter is not matched.
  • PowerQuery: The CQL restricts file events to executable writes; this query matches any file created under the folder.
  • PowerQuery assumes: Paths are reported with a drive letter (C:\Microsoft\Vault\), not as a device path.
  • PowerQuery assumes: The colon-and-backslash prefix matches only a folder directly under a volume root.
  • KQL – Defender XDR: Processes started from the folder are not covered; DeviceProcessEvents holds those and a single query cannot span two tables.
  • KQL – Defender XDR: The CQL restricts file events to executable writes; this query matches any file written under the folder.
  • KQL – Defender XDR assumes: FolderPath holds the full file path including the drive letter.
  • KQL – Defender XDR assumes: FileCreated, FileModified and FileRenamed are the action types for a write.
// HUNT: Executable under volume-root Microsoft\Vault (Aoki clipper drop)
// MITRE: T1115, T1036.005
// CONF: medium  FP: low  COST: low | REQUIRES: ProcessRollup2, PeFileWritten, NewExecutableWritten (FilePath, ImageFileName)
// FALSE POSITIVES: near none; the legitimate Windows Vault folders sit under ProgramData and user profiles, which the volume-root anchor excludes
// LOOKBACK: 30d (set in the time picker)
#event_simpleName=/^(ProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| (FilePath=/^\\Device\\HarddiskVolume\d+\\Microsoft\\Vault\\/i or ImageFileName=/^\\Device\\HarddiskVolume\d+\\Microsoft\\Vault\\/i)
| table([@timestamp, aid, ComputerName, UserName, FileName, FilePath, ImageFileName, SHA256HashData], limit=200)
09

Detection Rules by Platform

Prevent applies only to the three domains that both vendors publish. Every other rule is detect. No rule in this pack blocks a legitimate application's own file, because every path the stealer reads belongs to a real product.

CrowdStrike: Custom IOA

IOA nameRule typePatternExclusionsPromotesDeployment path
Aoki C2 domains named by both reportsDomain NameDomain matches (or is a subdomain of) dobeqnesmot[.]cc, hjazfioe[.]surf, neihite[.]ccNonePromote Q1PREVENT. Two independent vendors publish these three names.
Aoki C2 domains and IP named by Check Point onlyDomain Name and Network ConnectionDomain matches dfwioeiofwr[.]info, gate[.]dfwioeiofwr[.]info, kkeyyou[.]cc, somelitersofblood[.]pw; remote address 2[.]26[.]252[.]48NonePromote Q1, Q2DETECT only until a second source or your own sample analysis confirms them.
Executable under volume-root Microsoft\VaultFile CreationTarget path matches a folder named Microsoft\Vault directly under a volume rootNone expectedPromote Q7DETECT. Medium confidence, single source.
Known sample hashes (Falcon IOC Management, not an IOA)Custom IOC17 SHA-256 values from the CSV in section 10NonePromote Q3, Q4DETECT. Single-sourced hashes; SHA-1 values stay in Q4 because IOC Management does not take them.

Alert package: Q1 to Q4

SCHEDULED SEARCH NAME:  DETECT - Aoki Infostealer C2 or Sample Match (Q1, Q2, Q3, Q4)
DESCRIPTION:            Fires when an endpoint resolves or connects to published Aoki C2 infrastructure, or runs a published Aoki sample. A hit means AI-assistant, cloud, browser and wallet credentials on that host may already be stolen.
SCHEDULE / WINDOW:      every 15 minutes, last 30 minutes (Q1, Q2); hourly, last 90 minutes (Q3, Q4)
ALERT EMAIL SUBJECT:    [HIGH] Detection: Aoki Infostealer - C2 contact or known sample on <ComputerName>
ALERT EMAIL BODY:
  What fired: query <Q1|Q2|Q3|Q4> matched on <ComputerName> (aid <aid>) at <FirstSeen>.
  What it means: Aoki collects Claude, Codex, ChatGPT, Cursor, Copilot, Gemini and AWS credentials plus browser, wallet and messenger data and uploads it in one pass. Assume the data left the host.
  Immediate actions: network-contain the host; do NOT reimage yet; run pivot P1 and P2; start credential revocation for the user (runbook section 14).
  Escalation: SOC lead and IR on call within 30 minutes; notify the owners of any AWS account, AI provider organisation or Git organisation the user can reach.
TRIAGE CHECKLIST (L1):
  1. Confirm the host and user from the alert; check if it is a known malware-analysis or sandbox host.
  2. Run pivot P1 for the process that made the DNS request or connection, and its parent chain.
  3. Run pivot P2 for the first time the sample or any file from that path appeared (delivery clue).
  4. Network-contain the host in Falcon.
  5. List which AI tools, cloud CLIs and browsers the user has installed (software inventory).
  6. Hand the user and host to IR with the list from step 5 so credential revocation starts immediately.
  7. Run N1, N2, N4, N5 for the same user and time window.
  8. Record every finding in the hunt ticket (section 16).

Hunt package: Q5 to Q7

HUNT DESCRIPTION (investigate only, no alert email): Q5 multi-family AI credential store access, Q6 cleartext 8080, Q7 Vault drop.
Why not an alert: Q5 depends on a sensor-and-policy-dependent file-open event and is noisy until backup, indexing and DLP agents are excluded; Q6 only covers older builds; Q7 is single-sourced.
INVESTIGATION NOTES: run Q5 weekly for 4 weeks, review every process at 3 or more families, exclude approved agents by image name, then decide whether to promote.

Pivot queries (placeholders in angle brackets, not runnable until replaced)

// P1: who made the call. Replace <AID> and <PID> with aid and ContextProcessId from the hit.
#event_simpleName=ProcessRollup2
| aid="<AID>" TargetProcessId="<PID>"
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData], limit=20)

// P2: first sight of the same file on the host or across the environment. Replace <SHA256>.
#event_simpleName=/^(ProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| SHA256HashData="<SHA256>"
| groupBy([aid, ComputerName, FilePath], function=[min(@timestamp, as=FirstSeen), count(as=Events)], limit=1000)
| sort(FirstSeen, order=asc, limit=200)

// P3: everything that process opened in the AI and cloud credential families (environment-wide variant: drop the aid filter)
#event_simpleName=FileOpenInfo
| aid="<AID>" ContextProcessId="<PID>"
| table([@timestamp, ComputerName, TargetFileName], limit=200)

SentinelOne: custom detection rules

RuleSource queryRun asNotes
Aoki C2 domains named by both reportsQ1, PowerQuery tabScheduled custom detection ruleBind entities so the alert names the host instead of "Unknown Device"
Aoki C2 domains and IP named by Check Point onlyQ1, Q2, PowerQuery tabScheduled custom detection ruleBind entities so the alert names the host instead of "Unknown Device"
Executable under volume-root Microsoft\VaultQ7, PowerQuery tabScheduled custom detection ruleBind entities so the alert names the host instead of "Unknown Device"

Create the rule with POST /web/api/v2.1/cloud-detection/rules, queryType: "scheduled" and queryLang: "2.0", with the query in data.scheduledParams.query. Use 2.0 operator spellings: a rule written with the 1.0 token ContainsCIS was accepted and never fired on a tenant. The API does not warn, so lint the body before deploying.

Microsoft Defender: custom detection rules

RuleSource queryRun asNotes
Aoki C2 domains named by both reportsQ1, KQL – Defender XDR tabCustom detection rule, alert only, every hourThe query returns Timestamp, ReportId and DeviceId, which Microsoft recommends for Defender for Endpoint tables so alerts carry the device group scope and the process tree. Remove the Timestamp filter and the final sort and take before saving the rule: the service applies the rule's lookback itself
Aoki C2 domains and IP named by Check Point onlyQ1, Q2, KQL – Defender XDR tabCustom detection rule, alert only, every hourThe query returns Timestamp, ReportId and DeviceId, which Microsoft recommends for Defender for Endpoint tables so alerts carry the device group scope and the process tree. Remove the Timestamp filter and the final sort and take before saving the rule: the service applies the rule's lookback itself
Executable under volume-root Microsoft\VaultQ7, KQL – Defender XDR tabHunt only until the gap is closedQ7 is only an approximation here. Partial pivot: files created, modified or renamed under the volume-root Microsoft\Vault folder. The CQL also matches processes started from that folder, which sit in a different Advanced Hunting table.

Q3, Q4, Q5 and Q6 stay a hunt in this pack, not a rule. A rule can generate only 150 alerts per run. Continuous (NRT) frequency needs a single table and no comment lines, so delete the generated comment header from the query first.

10

Machine-Readable IOC Appendix

176 atomic indicators ship: 3 prevent (the three domains confirmed by both vendors) and 173 detect. Every value was copied from the saved snapshots by script, not typed. Falcon IOC Management takes the CSV rows; SHA-1 values are in their own block because that product does not import them.

Falcon IOC Management CSVbulk import
type,value,action,severity,expiration,description,tags
domain,dfwioeiofwr.info,detect,high,2027-04-27,Aoki C2 domain (Check Point only),campaign:Aoki
domain,dobeqnesmot.cc,prevent,high,2027-04-27,Aoki C2 domain (Symantec and Check Point),campaign:Aoki
domain,gate.dfwioeiofwr.info,detect,high,2027-04-27,Aoki C2 domain (Check Point only),campaign:Aoki
domain,hjazfioe.surf,prevent,high,2027-04-27,Aoki C2 domain (Symantec and Check Point),campaign:Aoki
domain,kkeyyou.cc,detect,high,2027-04-27,Aoki C2 domain (Check Point only),campaign:Aoki
domain,neihite.cc,prevent,high,2027-04-27,Aoki C2 domain (Symantec and Check Point),campaign:Aoki
domain,somelitersofblood.pw,detect,high,2027-04-27,Aoki C2 domain (Check Point only),campaign:Aoki
ipv4,2.26.252.48,detect,high,2027-04-27,Aoki C2 raw IP port 8080 older builds (Check Point only),campaign:Aoki
sha256,752c8e64af60960b85cf00e4bd34eb459e24b7939464f718ec18494df43b4b69,detect,high,2027-04-27,Infostealer.Aoki sample (Symantec only),campaign:Aoki
sha256,bf037920d39b85572ec7e53b51f09c28198c2c0afbc7c7d6cf639b1f047caebf,detect,high,2027-04-27,Infostealer.Aoki sample (Symantec only),campaign:Aoki
sha256,0adc8e83b2416c275b1283916d70568faddeb6d718eb45f9addfb0938db245b3,detect,high,2027-04-27,Infostealer.Aoki sample (Symantec only),campaign:Aoki
sha256,6655b89b9885483d459c73f2a52e3cec121de5c5956172a8676a0f4c2de94999,detect,high,2027-04-27,Infostealer.Aoki sample (Symantec only),campaign:Aoki
sha256,780bbdbb119befd4eb16e0c2ec0c64e7bedc1b53ce4f85804aea091a6e3af519,detect,high,2027-04-27,Infostealer.Aoki sample (Symantec only),campaign:Aoki
sha256,2fb80e2221bd304e7cd5ac04169e71807ad92d19836f1aaf7885295cb90b2d94,detect,high,2027-04-27,Infostealer.Aoki sample (Symantec only),campaign:Aoki
sha256,73dbac0907e8a092cd978f2787ab1994946f5da1e08f2bdbd05ea52e80cdb896,detect,high,2027-04-27,Infostealer.Aoki sample (Symantec only),campaign:Aoki
sha256,07bc2e3a1d14743cc44f1dc4c78d15d0f2b458b39fb48422b13df40fc662ba21,detect,high,2027-04-27,Infostealer.Aoki sample (Symantec only),campaign:Aoki
sha256,c533570fd7cd7eaf5478317b03ea5750d03797aa4d11ebd96555b6cb708c63f2,detect,high,2027-04-27,Infostealer.Aoki sample (Symantec only),campaign:Aoki
sha256,6350dfee6975a9b159c5a57a3e97f757b0b02fd2dc708016fa6d7270e720c865,detect,high,2027-04-27,Infostealer.Aoki sample (Symantec only),campaign:Aoki
sha256,36af3acc78058023cdcf9307bc15be640be9425de97e574fdaf42d03d308725b,detect,high,2027-04-27,Infostealer.Aoki sample (Symantec only),campaign:Aoki
sha256,039240551f88b0064b2615dffdc1321b1e7c58e3f617ac138a65a6d59400b331,detect,high,2027-04-27,Infostealer.Aoki sample (Symantec only),campaign:Aoki
sha256,0e38bd3c30a4ca08641240ce95b5b6ba593e131213ca1b2a28da4e0385fcabc4,detect,high,2027-04-27,Infostealer.Aoki sample (Symantec only),campaign:Aoki
sha256,3b4547f0d7549274f366cd9568b3d302c1e80e1b89359da681beb47260ec7975,detect,high,2027-04-27,Infostealer.Aoki sample (Symantec only),campaign:Aoki
sha256,b590235493487c51f7050b341c9b2450e4f761ad6055207e4f6daf0cecae271c,detect,high,2027-04-27,Infostealer.Aoki sample (Symantec only),campaign:Aoki
sha256,e374f9ff5094f728528efa566c3de1b7fea7d95f497242a01fffa6c70b5eb768,detect,high,2027-04-27,Infostealer.Aoki sample (Symantec only),campaign:Aoki
sha256,f779314b1a5a0b297fd4e2a5f9c1e40d387b3e7c401d42324b556a70f813840e,detect,high,2027-04-27,Infostealer.Aoki sample (Symantec only),campaign:Aoki
# NOT imported: 151 SHA-1 hashes and the clipper SHA-1 (Falcon IOC Management does not take SHA-1). They are in the grab-sha1 block and Q4.
# NOT imported: URL, user agent, header, pipe, file name and path indicators. Use the behavioral block and the queries.
# Only the three domain rows marked prevent are corroborated by two vendors. Every other row is detect.
Microsoft Defender indicators CSVSettings, Endpoints, Indicators, Import: audit and block
indicatorType,indicatorValue,action,title,description,expirationTime,severity,recommendedActions,rbacGroups,category,mitretechniques,GenerateAlert
DomainName,dfwioeiofwr.info,Audit,Aoki C2 domain,Aoki C2 domain (Check Point only),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
DomainName,dobeqnesmot.cc,Block,Aoki C2 domain,Aoki C2 domain (Symantec and Check Point),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
DomainName,gate.dfwioeiofwr.info,Audit,Aoki C2 domain,Aoki C2 domain (Check Point only),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
DomainName,hjazfioe.surf,Block,Aoki C2 domain,Aoki C2 domain (Symantec and Check Point),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
DomainName,kkeyyou.cc,Audit,Aoki C2 domain,Aoki C2 domain (Check Point only),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
DomainName,neihite.cc,Block,Aoki C2 domain,Aoki C2 domain (Symantec and Check Point),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
DomainName,somelitersofblood.pw,Audit,Aoki C2 domain,Aoki C2 domain (Check Point only),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
IpAddress,2.26.252.48,Audit,Aoki C2 raw IP port 8080 older builds,Aoki C2 raw IP port 8080 older builds (Check Point only),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
FileSha256,752c8e64af60960b85cf00e4bd34eb459e24b7939464f718ec18494df43b4b69,Audit,Infostealer.Aoki sample,Infostealer.Aoki sample (Symantec only),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
FileSha256,bf037920d39b85572ec7e53b51f09c28198c2c0afbc7c7d6cf639b1f047caebf,Audit,Infostealer.Aoki sample,Infostealer.Aoki sample (Symantec only),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
FileSha256,0adc8e83b2416c275b1283916d70568faddeb6d718eb45f9addfb0938db245b3,Audit,Infostealer.Aoki sample,Infostealer.Aoki sample (Symantec only),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
FileSha256,6655b89b9885483d459c73f2a52e3cec121de5c5956172a8676a0f4c2de94999,Audit,Infostealer.Aoki sample,Infostealer.Aoki sample (Symantec only),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
FileSha256,780bbdbb119befd4eb16e0c2ec0c64e7bedc1b53ce4f85804aea091a6e3af519,Audit,Infostealer.Aoki sample,Infostealer.Aoki sample (Symantec only),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
FileSha256,2fb80e2221bd304e7cd5ac04169e71807ad92d19836f1aaf7885295cb90b2d94,Audit,Infostealer.Aoki sample,Infostealer.Aoki sample (Symantec only),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
FileSha256,73dbac0907e8a092cd978f2787ab1994946f5da1e08f2bdbd05ea52e80cdb896,Audit,Infostealer.Aoki sample,Infostealer.Aoki sample (Symantec only),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
FileSha256,07bc2e3a1d14743cc44f1dc4c78d15d0f2b458b39fb48422b13df40fc662ba21,Audit,Infostealer.Aoki sample,Infostealer.Aoki sample (Symantec only),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
FileSha256,c533570fd7cd7eaf5478317b03ea5750d03797aa4d11ebd96555b6cb708c63f2,Audit,Infostealer.Aoki sample,Infostealer.Aoki sample (Symantec only),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
FileSha256,6350dfee6975a9b159c5a57a3e97f757b0b02fd2dc708016fa6d7270e720c865,Audit,Infostealer.Aoki sample,Infostealer.Aoki sample (Symantec only),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
FileSha256,36af3acc78058023cdcf9307bc15be640be9425de97e574fdaf42d03d308725b,Audit,Infostealer.Aoki sample,Infostealer.Aoki sample (Symantec only),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
FileSha256,039240551f88b0064b2615dffdc1321b1e7c58e3f617ac138a65a6d59400b331,Audit,Infostealer.Aoki sample,Infostealer.Aoki sample (Symantec only),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
FileSha256,0e38bd3c30a4ca08641240ce95b5b6ba593e131213ca1b2a28da4e0385fcabc4,Audit,Infostealer.Aoki sample,Infostealer.Aoki sample (Symantec only),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
FileSha256,3b4547f0d7549274f366cd9568b3d302c1e80e1b89359da681beb47260ec7975,Audit,Infostealer.Aoki sample,Infostealer.Aoki sample (Symantec only),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
FileSha256,b590235493487c51f7050b341c9b2450e4f761ad6055207e4f6daf0cecae271c,Audit,Infostealer.Aoki sample,Infostealer.Aoki sample (Symantec only),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
FileSha256,e374f9ff5094f728528efa566c3de1b7fea7d95f497242a01fffa6c70b5eb768,Audit,Infostealer.Aoki sample,Infostealer.Aoki sample (Symantec only),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True
FileSha256,f779314b1a5a0b297fd4e2a5f9c1e40d387b3e7c401d42324b556a70f813840e,Audit,Infostealer.Aoki sample,Infostealer.Aoki sample (Symantec only),2027-04-27T00:00:00.0Z,High,Investigate the device and pivot into the pack's queries,,,,True

Column names and allowed values are from Microsoft's documented parameter table. Prevent rows import as Block, without remediation; network indicators cannot use BlockAndRemediate. Check each expirationTime before importing: an indicator whose date has passed is already expired. Download the sample CSV from the Import page to confirm the column order before a bulk import. Each file takes at most 500 indicators. Learn describes the import per entity type, so if a mixed file is rejected, split it by indicatorType. An imported indicator does nothing unless the matching Advanced features are on (for example Custom network indicators and Allow or block file).

SentinelOne IOC importnot included

This pack does not ship a SentinelOne import block: the import format could not be verified against SentinelOne's own documentation. Export a sample from your console and the block can be added with confidence.

SHA-1 hashes (Check Point)150 + 1 clipper
# Aokigahara SHA-1 (Check Point). Detect only. Used by Q4.
007137599bc4d69ee952a5228b5fcb2c3b9a95a7
00d52c7e759d878f0d8a117502f6d854af13f007
04eddccb79db41e03a4ee8542e8a33d7f1d9fe18
057a2d1dedeb93b7765c455a9e0c469e7cbe4843
079ddf5cc7d6ca2e02f860f87d4d18c83db9d331
0b74ce90a39278fb97fe94f6306af71cbe679503
0c46ac5555cf8f305c1345a21d0802c52bf52cd8
0d8d0bad2e08856ba379e425e2e90e49506af631
0e76150cee3f2b89f0fbe39106ab2898db109f09
0f69792cb926a416766d47a30a05009c13be0d64
130f2710cf9863bdd6724e8912600505b6fb7ef2
133dc00ad81638e6b0a2f8f163b4d694ce477165
151d8013ca3ab3dab9cd37f4ed9870cc83e87a77
1701db4fa798b309cb25227408406dde4c69de8a
1835f1e0b1eda3dc4b39682ecad3eba88cbbc44e
18e041b5a0c668392ff4d036f3f9660c2698311e
1a6a6e08a01cc3f1455af2c4ecd59a3d7802cd7a
1a7248720f3ac79082841b006582f20799b314a9
1a97a18db74f2b6df984c9a188a79b4e65a06b81
1cb6ccfdcb277a0277729443d15f17a441fa0eda
1cb8dc11bdb8baf342b83079fb650cd6bb1b132d
1e072236f87cd914dc583ca2163460d656bfcfba
1e94d7f1d501724076fcf98459e14b68321d45f7
2045f165d737f2d43ba603d444dfa5d9e6f05805
211e45f306b84a82cfe736635c176a424e7479dc
21ef070e39f651118a804882374dc2dfa3e38666
2362a326070d83c167251873b389bd783781cf6c
241e37b8fc5ffeefbd1d89a82b74cf2d92b49eac
244371fc1642f0548b807b0a4a2e7ea5d7b4c82a
28099fc5a8cbbd40173f8ac0aded9044fdb4a598
2cdc77108c585d14b1567053b8f8a58ea78c255f
2f30b116ca3dc48ff5783c3bb7391d671866e27b
30737fa46f2ff93e33f45008cf306233954ea898
324e0fffc7977f8ff591993819123d33c2970953
3586eeaf3ffe2c3a4f1d005aee863b7aee7cc7bd
3696baa239c479f9f5103618214972890f1a473b
385e21a96687a33f79f9cab0627aec7218e1a8f4
38b2c29b46086b417181deb958e8b276a9d1fbf4
3aaeb49864108c92af50feeb5d9e3b3efaa39818
3c56a0c3c59a1425bfdcdffda9e8b308f478b147
426bea548a24f7f39c279770b5dd21fbed7f7328
4417d2645adb6e7e94959daf483f93058500840f
4485feb1385975ef13f08148cdc679f50fa0cc6d
456414c0acf463e06f95f5bd3d8355758fca6b53
4595d1875441ffb8c076856e366d1f4f5c74a679
48c6b66dc4b4d40d72b7460e6fd670b6c03d5d40
4b3a4ad0acd43fc8796147381074a98e8e576904
4c07021f8b0cdd3ca334a13f9af2bade9e699dc2
50060c0fc5fa8932671eb24b03b05d00c2e99951
51ae6cad54f33846f83a352457b9a44ef8b7a61d
59bbaca8a848215e7e4af7cec320432c51b0b812
5ef7eb755f1e3f6bf8586794777466a639057dcb
5fadf206dc163f63ebf66f984042b00c67121813
5fe11fbb89d33efa712ffb8590626bd88fecab8f
61a024f5a42a9a91b0a9871a1613c7fb3ef5613b
62dcc9ba2a5eee9dd941ad08766603c89a45869b
6393c0d3fb76f771a9418c2d152c621929ee002b
63cc5033532cd00bda3d4968b1257629e613505a
682dd6392004e1131b1aa3f2351a0bc7adb84d14
699c809a116106da40b3f641c11b0db34d0f1c5e
6a09fffca381f6624d2def1083284ca486306e7c
6c860007f8f49de8e9848b538bd7acdc6bfcdf55
6e073a196a9bfa01da418b5783c2395fb22c7ec9
6eb8f17dba69f6d25b7f5c529b25d199707b69e2
6f7d5935602c188b1e3066b4ab9aeef7b85a8ec2
70915fac07af4ad7acc1868fe05dc00b98206f0f
70d4007b11e56752fffb81f71c90987f4bb441fa
70e91644802053cfa68be6ec0f94207282ff27e4
7233a15327dc2f0cca0292e6352eebf6e6e090d8
72aa6417a19c45dabdd6c79087fb13c73ae7b823
7cc6c75fad93b2482a9c5f4522530007c72f99e0
82ebfc09c98bd211ff8b08efcd8ec8b9ce1fb4be
83b43ce0ee9881201451c0604fb5b792bd4581f5
86230c07e638b85bc8010df1aa9e33ca61fda4cc
89f296aef7988bdd59109e4263d0a31c886770aa
8b0cf62382f620bbbf5d176295d63ed522ab9c2c
8c3111a61fbf30e86b8206397ce3c0017e5ea509
8c4c1d8325adb463c34694ce3a5a851e97b81a6f
8d7a81119ce7be6eb452192f08fa2669228ff597
8d860ca64ce0cbf40871fd66b9e3a513e73cda90
8dc40b7208b8c0d95d1ab8dda9a56fff790b3ddd
8e9fd1274b77ff9726c4637d008a9d599c9d5f1e
9003310bf73dc337b8b50131f1c0724a79161aac
90c057dafefbee423e3014266218272d454a0aa3
912ed8ce7767f94f62de6a30fb8e9df7c0c512f7
9369e0e5eae22cff71b375ad285ea89471f25101
97c80e2d382e6e55f61702da3afb838fdec2f4f1
98c6649cc256dfadf1af939da46f037b05c0f2e5
99b28a20851a3ed29769a469f4dd31ebbb8a83de
9d424ce23753ffddc7b39477222123b0f2c33066
9f05045f5447d79c8c0d0f5cb589fd85c89620d3
9f20034441e78574aec7ad39842a342f939eaf6a
a00da33342a5ea5168d851a5c93109e07cf95c49
a2abdf1af38da9995a3b6672ce6c34e9e17c39a4
a4871f4a61faf74e1cceaffe26901f6076c9f37e
a63ded811d412cd0f859891b0c1f066b87bb1b80
a84148b4d408544325c20ee04299ae95c762b6a2
ad960d2abb1999a7260c5f498532a5bb8754c2a5
ae9d6b1a32a45b05edb920538e538a3d6a5fe439
af196456d2ebf9556ab239661922565e1bca9ac0
b335483800d35a29c25767c917725e24c21b0f2b
b33e59c598845d2547ddc7f654115df2284bb3ae
b36d0796e33f808eaeb33b33908327a410680c56
b4491f1919a88deedebe7fba56b593e7d6655458
b523d56d82485253f2e3619437c8398b7ee0f20d
b607025d3e06d1e8cffcd398c64871d7fcd92bf4
b6f0dfd3aa2fc7b8b2ad432c4a4276da23ceb46b
bab4c910e3c98085bf228519f346d071a75e44e3
bad339c5ad65808285b0e87498f2ea6f669417d9
c00aceaa40b38e48f662ac927bb86302934aaf96
c2e28ba5523c1f3a545a0b4a00a9d5e9c8ae7583
c323c59815082ac842f0bafcc01f537444e1cc5a
c5b50b5e14dfb5e028dfd88a4e4fb960dd650b52
c810acdf30bcdfc6e8021e7f62a3bcce0828c2ee
c8456bb71a74ed6305455c318295b8a39e9277f3
cbdff0df0dbdbc3c1845d208661dd75fd335ef93
cc12fcb9e5e6f7afde66f5c3452ed6e3cd6d5390
cc708ae3d7aa084279122c0db7250096f750d6b0
d34491da5aa159314129c0ff67f957d873703e35
d3c90275dd7279a791d717676be15789376f7aa7
d8bfff5139b54b6f98f07c051cd25d7aa465fec8
da986a3cb2ce67456ef374fbdd957d370a1a4367
daef439e1f110d624ce50fe0f9d9d24f61f7497b
db3332ce75676389b79cf3603d81cb231cb7c19c
db69c7c930fd5dc5097847979a965fdea4171d5b
dba5fef27b53ff479a4d7046cd1f22710081a16c
de9d152010819c8fb5cb611a4de920399e69cfeb
dfd1540c0185e74ec65acfcae1af7ba0da36c774
e052ff49190f54e0ffc52f7b3f7b5e7b9e121c4c
e3af6d9e3b35e5e04feda3cde96256dd3b099624
e4d93fa1b2d0fd26e8b877511ea33badb4628169
e5c43abd1c212b2f2a61d5e1cb7821406ca5dc8e
e8d09eb2e5857fde39b44aeb48078f5396809026
ec7cd90d56e5b73caa9d4eb0472bfee68d716121
eec7ece53d47e50940584f4dec684a24a78f42f2
f0b23f420659babb3a730b122259440091c53c12
f30e9730db0663f87c67a4b9a0cf12ee59b1621a
f35e6d2936c0f6dc26bdc68f6d1599cf438a863a
f4184e1bb61e19d190555c50fdb9d4591767bf53
f47d45eea1c42b066f8537baf72ffa266646bf62
f5993e64a18e7494b25a185de9f63a1df961b99a
f633fc9fd16dadca2725d3d54aaf13ea1a62174f
f6d950a5a8e5ba336f748b66745c6c1f189d3362
f8cf33b18e9932d285696fee40a7fee2a87341c2
f8dbc552c89bef758e4fcbd9942d06bc0c11db0a
f990bf4f05dfa4d86b3e3bc0a54f62e91b83f2c6
fa61cf3bebefd88ea9d06007a4b85791aa851c8a
fbe8708247fabd8a1bc3963db3911b5e77728669
fe6b7d6fa8c2424d14a0d465ab78aaf83db0d07b
ff402e64bc42222c8a4ee703123903c2a2117dd9
# Clipper component SHA-1 (Check Point). Detect only.
8d6c86e0af7807f9b5baf15e9f076bb81e012515
SHA-256 hashes (Symantec)17 values
# Infostealer.Aoki SHA-256 (Symantec). Detect only. Used by Q3.
752c8e64af60960b85cf00e4bd34eb459e24b7939464f718ec18494df43b4b69
bf037920d39b85572ec7e53b51f09c28198c2c0afbc7c7d6cf639b1f047caebf
0adc8e83b2416c275b1283916d70568faddeb6d718eb45f9addfb0938db245b3
6655b89b9885483d459c73f2a52e3cec121de5c5956172a8676a0f4c2de94999
780bbdbb119befd4eb16e0c2ec0c64e7bedc1b53ce4f85804aea091a6e3af519
2fb80e2221bd304e7cd5ac04169e71807ad92d19836f1aaf7885295cb90b2d94
73dbac0907e8a092cd978f2787ab1994946f5da1e08f2bdbd05ea52e80cdb896
07bc2e3a1d14743cc44f1dc4c78d15d0f2b458b39fb48422b13df40fc662ba21
c533570fd7cd7eaf5478317b03ea5750d03797aa4d11ebd96555b6cb708c63f2
6350dfee6975a9b159c5a57a3e97f757b0b02fd2dc708016fa6d7270e720c865
36af3acc78058023cdcf9307bc15be640be9425de97e574fdaf42d03d308725b
039240551f88b0064b2615dffdc1321b1e7c58e3f617ac138a65a6d59400b331
0e38bd3c30a4ca08641240ce95b5b6ba593e131213ca1b2a28da4e0385fcabc4
3b4547f0d7549274f366cd9568b3d302c1e80e1b89359da681beb47260ec7975
b590235493487c51f7050b341c9b2450e4f761ad6055207e4f6daf0cecae271c
e374f9ff5094f728528efa566c3de1b7fea7d95f497242a01fffa6c70b5eb768
f779314b1a5a0b297fd4e2a5f9c1e40d387b3e7c401d42324b556a70f813840e
Network indicatorsdefanged
C2 hosts (defanged, for sharing)
dfwioeiofwr[.]info   [Check Point only]
dobeqnesmot[.]cc   [both reports]
gate[.]dfwioeiofwr[.]info   [Check Point only]
hjazfioe[.]surf   [both reports]
kkeyyou[.]cc   [Check Point only]
neihite[.]cc   [both reports]
somelitersofblood[.]pw   [Check Point only]
2[.]26[.]252[.]48:8080   [Check Point only]
hxxps://dobeqnesmot[.]cc/gate   [Symantec]
Behavioral Signaturessearch strings
HTTP (proxy or TLS inspection logs only)
  Paths:        /gate/handshake   /gate/chunk   /gate/complete
  Methods:      POST, Content-Type application/octet-stream
  Headers:      X-Build-ID  X-Gate-Token  X-Session  X-HWID  X-KEX: x25519  X-Chunk  X-Chunk-Index  X-Total
  User agent:   Microsoft-CryptoAPI/10.0   (latest analysed builds; earlier builds used other strings)
  Shape:        handshake body = 32 bytes (X25519 public key); chunk body = 12-byte nonce + AES-GCM ciphertext + 16-byte tag; complete body = the 8 bytes COMPLETE
  Chunk labels: sysinfo  screenshot  clipboard  browsers  firefox  aisessions  (X-Chunk header)
Host artifacts
  Named pipe:   \\.\pipe\akg_<hex>_<hex>
  Temp file:    <profile temp>\kmd_w_<n>_<n>.db
  Drop folder:  C:\Microsoft\Vault\   (clipper component, volume root)
  PE section:   .stgcfg   magic STGC   (AES-256-CBC config; key derived from a seed; IV stored in the blob)
  Strings:      X-Chunk-Index: %u   X-Build-ID: %s   AKGRES   AISessions/   aokigahara   /chunk   .ROBLOSECURITY
  Key derivation string for the C2 key: aokigahara (SHA-256 of shared secret plus this string)
  Language guard: exits when keyboard layout or UI language is one of 0x0419 0x0422 0x0423 0x0428 0x042B 0x042C 0x0437 0x043F 0x0440 0x0442 0x0443
Process lineage worth watching
  A user-writable-path process, not a browser, opening many unrelated app-data folders in seconds, then a burst of HTTPS POSTs to one new domain.
AI and cloud credential storeshunt surface only
# HUNT SURFACE ONLY (detect, never prevent). Every path below belongs to a legitimate application.
# Source: Check Point aisessions handler paths. %s = the user profile, AppData Roaming or Local root as the sample resolves it.
Claude Code / Desktop:  .claude\credentials.json   .claude.json   Claude\   Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude
Codex:                  .codex\auth.json   .codex\config.toml   .codex\.env
ChatGPT Desktop:        Packages\OpenAI.ChatGPT-Desktop_2p2nqsd0c76g0\LocalCache\Roaming\ChatGPT
Cursor:                 Cursor\User\globalStorage\state.vscdb   storage.json   (also "Cursor - Insiders")
Windsurf / Codeium:     Windsurf\User\globalStorage\state.vscdb   Windsurf - Next\...   .codeium\config.json
Kiro:                   .aws\sso\cache\kiro-auth-token.json   Kiro\User\globalStorage\kiro.kiroagent\profile.json
VS Code:                Code\User\globalStorage\state.vscdb   (also "Code - Insiders")
GitHub Copilot:         .copilot\config.json   .copilot\hosts.json
Gemini CLI:             gemini-cli-workspace-token.json   .gemini-cli-workspace-master-key   .gemini\.env   .gemini\config.json
JetBrains AI:           JetBrains\*   JetBrains\<product>\options\AIAssistantQuotaManager2.xml
AWS / Amazon Q:         .aws\credentials   .aws\config   .aws\sso\cache   amazon-q\data.sqlite3
Also from the ide handler: Git credential files, .ssh (private keys), Azure and Google Cloud credential and config files
Credential rotation checklistresponse
# Credential rotation checklist for any host with a Q1, Q2, Q3, Q4 or Q7 hit (do before or with reimage)
[ ] AI providers: sign out all sessions and revoke API keys for Claude, ChatGPT/OpenAI, Gemini, Cursor, Windsurf/Codeium, Kiro, JetBrains AI, GitHub Copilot
[ ] AWS: deactivate and rotate access keys; revoke SSO and role sessions; review CloudTrail for the key ids (N4)
[ ] Azure and Google Cloud: revoke CLI sessions and service-principal secrets stored in profile config
[ ] Git: revoke personal access tokens and OAuth grants; rotate SSH keys found under .ssh; review the audit log (N5)
[ ] Browsers: sign out everywhere, reset passwords for saved logins, treat saved cards as exposed
[ ] Password manager: rotate the master secret and review vault items; KeePass files and config were targeted
[ ] Crypto: move funds from any wallet or extension on the host to a new wallet created on a clean device
[ ] Messengers and games: terminate Discord, Telegram and Steam sessions; rotate recovery codes
[ ] VPN, FTP and mail clients: rotate stored credentials; Outlook and Thunderbird profiles were targeted
[ ] Then reimage the host and rebuild from a clean image
11

Detection Validation Gates

GateCheckPass condition
Telemetry readyDNS lookup with requesting process (CrowdStrike: DnsRequest. SentinelOne: DNS Resolved. Defender: DeviceEvents DnsQueryResponse); outbound connection (CrowdStrike: NetworkConnectIP4. SentinelOne: IP Connect. Defender: DeviceNetworkEvents); process creation with hash (CrowdStrike: ProcessRollup2. SentinelOne: Process Creation. Defender: DeviceProcessEvents). For Q5 only: file open on a named path (CrowdStrike: FileOpenInfo).Q1 to Q4 and Q6, Q7 depend on common events and should return rows for a test host. For Q5, open a harmless file such as an empty .codex\config.toml in a test profile and confirm a file-open row arrives within minutes; if none does, Q5 is blind in that tenant and the coverage map must say so.
Benign baselineRun Q5 and Q6 for 14 days in investigate mode before alerting. Run Q1 to Q4 and Q7 over 90 days.Q1 to Q4 and Q7 return only test or sandbox hosts. Q5 and Q6 hits are all explained by named agents or tools, which are then excluded by image name.
Positive testsQ1, Q2: resolve or connect to a name or address from a controlled test host after adding a harmless local DNS override; do not contact the real infrastructure from a production host. Q3, Q4: place a copy of a hash-matching file only in a controlled analysis environment. Q7: create a harmless test executable in a root-level Microsoft\Vault folder on a test host.Each query returns the test event. Delete test artifacts afterward.
PromotionQ1 and Q2 to the alert package; the three corroborated domains to a prevent IOA; Q3, Q4, Q7 to detect; Q5 and Q6 stay investigate-only.Q1 to Q4 and Q7 return nothing but test hosts for 14 days. Nothing else is promoted to prevent without a second independent source.
12

Hardening: Tiered & Deployable

Immediate (this week)
  • T1. Get long-lived AI and cloud secrets out of plaintext files. The stealer reads .codex\.env, .gemini\.env, config.toml, .aws\credentials and similar files directly. Move secrets to the OS credential store or a secrets manager, delete stray .env files in tool folders, and stop pasting keys into tool config. Framework: ATT&CK T1552.001 and M1022, M1027, M1041. Verify: scan tool folders for key-shaped strings (Playbook P3 lists the files to check).
  • T2. Block the three corroborated C2 domains at DNS and web gateway, and alert on the rest. Block dobeqnesmot[.]cc, hjazfioe[.]surf, neihite[.]cc. Alert, do not block, on the four Check Point-only domains and the one IP until a second source or your own analysis confirms them. Framework: M1037 Filter Network Traffic, M1021 Restrict Web-Based Content. Verify: Playbook P1 and a test lookup from a lab host.
  • T3. Shorten token lifetime and drop long-lived AWS keys. Use IAM Identity Center sessions with short durations instead of static access keys, and deactivate unused keys. A stolen SSO cache is only useful until it expires. Framework: M1027, M1032; AWS IAM best practices. Verify: Playbook P4 key inventory.
Near term (1 to 4 weeks, pilot first)
  • T4. Stop browsers from storing what the stealer wants. Disable the built-in password manager and card autofill in managed Chrome and Edge, and move to an enterprise password manager with its own protections. Cookies still exist, so pair with short session lifetimes on SaaS and AI tools. Framework: M1054 Software Configuration; CIS Google Chrome and Microsoft Edge Benchmarks (browser password and autofill settings). Verify: Playbook P2 and the browser policy page.
  • T5. Restrict what can run from user-writable folders. Delivery is unknown, so cut the common execution path: enable the Defender ASR rule that blocks executables that do not meet prevalence, age or trusted-list criteria in audit mode, then enforce; or the equivalent Falcon prevention setting. Start WDAC or AppLocker in audit mode for developer groups. Framework: M1038 Execution Prevention, M1033, M1045; Microsoft Defender attack surface reduction rules documentation. Verify: Playbook P5. ASR rules need Defender Antivirus in active mode; on Falcon-only hosts use the Falcon policy instead.
  • T6. Separate developer identity from production reach. Keep production cloud credentials and deploy rights off the laptop that runs AI coding tools: use short-lived role assumption through a gateway, and conditional access that binds sessions to managed devices. Framework: M1018, M1026, M1032; NIST SP 800-207 zero trust tenets. Verify: review which roles a developer laptop session can assume.
Strategic (1 to 3 months)
  • T7. Put spend caps, usage alerts and key restrictions on every AI provider account. LLMjacking shows up first as usage or billing. Set organisation spend limits, per-key limits, and alerts on new keys; restrict keys to approved addresses where the provider supports it. ⚠ best-practice, no formal benchmark: confirm each provider's controls in its own documentation.
  • T8. Plant canary credentials in the stores a stealer reads. Fake AWS keys and a fake API key in a dummy .env inside a monitored profile give a high-confidence alert the first time anyone uses them, whatever the malware build. Framework: M1056 Pre-compromise (deception). ⚠ best-practice, no formal benchmark.
  • T9. Make developer endpoints a managed tier. Application control, EDR with file-open telemetry enabled where the product supports it, and a paved path for installing AI tools, so unsanctioned binaries stand out. Framework: M1038, M1047 Audit.

What to verify after deployment. Run Q1 to Q4 and Q7 weekly; a CQL spot-check for T2: #event_simpleName=DnsRequest filtered to the three blocked names should show lookups that now resolve to your sinkhole or fail, and no outbound connection should follow from the same process.

13

Deployable Playbooks

P1 · Sinkhole the corroborated C2 domains

Playbook P1: sinkhole the three corroborated C2 domains (Windows DNS Server)
Prerequisites: a Windows DNS Server that your clients use; DNS admin rights. Clients that use DoH or an external resolver bypass this.
Reboot required: no
1. Create an empty primary zone for each name. Names under it then answer as non-existent.
   $names = @('dobeqnesmot.cc','hjazfioe.surf','neihite.cc')
   foreach ($n in $names) {
     if (-not (Get-DnsServerZone -Name $n -ErrorAction SilentlyContinue)) {
       Add-DnsServerPrimaryZone -Name $n -ZoneFile "$n.dns" -DynamicUpdate None
     }
   }
2. Verify from a client:
   foreach ($n in $names) { Resolve-DnsName $n -ErrorAction SilentlyContinue }
   # Expect: no A record returned
3. Do NOT add the four Check Point-only domains or the IP to a block list yet. Add them to an alert-only list.
Rollback:
   foreach ($n in $names) { Remove-DnsServerZone -Name $n -Force }
   # Removes the sinkhole zones. Run only if a name turns out to be legitimate for your business.

P2 · Browser password and card storage policy

Playbook P2: stop managed Chrome and Edge from saving passwords and cards
Prerequisites: an enterprise password manager is rolled out first, so users are not left without storage; local admin or GPO rights. Test on a pilot ring.
Reboot required: no (browsers read policy at next start)
1. Set policy values (registry form of the GPO settings):
   $targets = @('HKLM:\SOFTWARE\Policies\Google\Chrome','HKLM:\SOFTWARE\Policies\Microsoft\Edge')
   foreach ($t in $targets) {
     if (-not (Test-Path $t)) { New-Item -Path $t -Force | Out-Null }
     New-ItemProperty -Path $t -Name PasswordManagerEnabled -Value 0 -PropertyType DWord -Force | Out-Null
     New-ItemProperty -Path $t -Name AutofillCreditCardEnabled -Value 0 -PropertyType DWord -Force | Out-Null
   }
2. Verify: open chrome://policy and edge://policy and confirm both values show as set.
   Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Google\Chrome' | Select-Object PasswordManagerEnabled, AutofillCreditCardEnabled
3. Note: this does not remove passwords already saved. Export or migrate, then clear stored logins, as a separate planned step.
Rollback:
   foreach ($t in $targets) {
     Remove-ItemProperty -Path $t -Name PasswordManagerEnabled -ErrorAction SilentlyContinue
     Remove-ItemProperty -Path $t -Name AutofillCreditCardEnabled -ErrorAction SilentlyContinue
   }

P3 · Audit plaintext secrets in AI tool and cloud folders

Playbook P3: find key-shaped secrets left in AI tool and cloud config folders (read-only audit)
Prerequisites: run as the user being checked, or as admin against each profile; PowerShell 5.1 or later. This script only reads and prints file names, never file contents.
Reboot required: no
1. List the files the stealer reads that exist on this profile:
   $roots = @("$env:USERPROFILE\.claude.json","$env:USERPROFILE\.claude","$env:USERPROFILE\.codex","$env:USERPROFILE\.gemini","$env:USERPROFILE\.codeium","$env:USERPROFILE\.copilot","$env:USERPROFILE\.aws","$env:USERPROFILE\.ssh")
   foreach ($r in $roots) { if (Test-Path $r) { Get-ChildItem -Path $r -Recurse -Force -File -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime } }
2. Flag stray dotenv files in those folders:
   Get-ChildItem -Path $env:USERPROFILE -Recurse -Force -File -Filter '.env' -Depth 3 -ErrorAction SilentlyContinue | Select-Object FullName
3. For each hit: move the secret to the OS credential store or a secrets manager, rotate it, then delete the plaintext file.
Rollback: none required. The script is read-only. Deleting a plaintext secret in step 3 cannot be undone, so rotate the secret first and keep a copy only in the secrets manager.

P4 · Retire long-lived AWS keys

Playbook P4: inventory and retire long-lived AWS access keys
Prerequisites: AWS CLI v2 with IAM read access, and IAM write access for the deactivation step. Confirm with each key owner before deactivating.
Reboot required: no
1. Report credential age and use for every user:
   aws iam generate-credential-report
   aws iam get-credential-report --query Content --output text | base64 --decode > credential-report.csv
2. List keys for a user and when each was last used:
   aws iam list-access-keys --user-name <USER_NAME>
   aws iam get-access-key-last-used --access-key-id <ACCESS_KEY_ID>
3. Deactivate (do not delete) a key that is unused or exposed:
   aws iam update-access-key --user-name <USER_NAME> --access-key-id <ACCESS_KEY_ID> --status Inactive
4. Move people to IAM Identity Center sessions and set a short session duration for the permission set.
Rollback:
   aws iam update-access-key --user-name <USER_NAME> --access-key-id <ACCESS_KEY_ID> --status Active
   # Reactivates a key that turned out to be needed. Do not reactivate a key that was exposed.

P5 · ASR prevalence rule, audit first

Playbook P5: Defender ASR rule for executables that fail prevalence, age and trusted-list checks (audit first)
Prerequisites: Defender Antivirus in active mode (ASR does not enforce when another AV is primary); local admin. On Falcon-only hosts use the Falcon prevention policy for unknown executables instead.
Reboot required: no
1. Turn the rule on in audit mode:
   Add-MpPreference -AttackSurfaceReductionRules_Ids 01443614-cd74-433a-b99e-2ecdc07bfc25 -AttackSurfaceReductionRules_Actions AuditMode
2. Verify:
   $i = (Get-MpPreference).AttackSurfaceReductionRules_Ids
   $a = (Get-MpPreference).AttackSurfaceReductionRules_Actions
   for ($n=0; $n -lt $i.Count; $n++) { if ($i[$n] -eq '01443614-cd74-433a-b99e-2ecdc07bfc25') { "Action: $($a[$n])" } }
   # Expect: 2 (Audit). 1 means Block.
3. Review audit events for 14 days, allow-list legitimate developer tools, then switch the action to Block for the pilot ring.
Rollback:
   Remove-MpPreference -AttackSurfaceReductionRules_Ids 01443614-cd74-433a-b99e-2ecdc07bfc25
14

Containment Runbook

PhaseActionsOwnerEvidence
IsolateNetwork-contain the host in Falcon. Do not power off (memory and temp files may hold evidence). Do not reimage yet. Suspend the user's AI, cloud, Git and browser sessions at the identity provider so stolen tokens stop working while you scope.SOC / IRContainment timestamp, host and user, session-revocation record
Isolate: by platformCrowdStrike: network-contain the host. SentinelOne: network quarantine (Disconnect from Network; confirm the label in your console version). Microsoft Defender: Isolate device (full network isolation). Keep the host powered on for memory capture on all of them.SOC / IRContainment timestamp, host and user, session-revocation record
ScopeRun pivots P1 to P3. Run N1 and N2 for other hosts that contacted the same names. List the AI tools, cloud CLIs, browsers, wallets, password managers and messengers on the host (the targets are in section 10).IRProcess tree, first-seen file, host software list
Revoke and rotateWork the rotation checklist in section 10 in this order: cloud and CI/CD access first, then AI providers, Git, identity provider, browsers, password manager, wallets, messengers. Review N4 to N6 for use between the first possible infection and revocation.IR / Cloud / Identity ownersRotation checklist with timestamps, cloud and provider log extracts
EradicateCollect the sample and the parent file for analysis, then reimage. Do not try to clean in place: the stealer has no persistence in the reports, but other tooling may be present. Reset local admin and profile secrets after the rebuild.IR / EndpointSample hashes (add to the CSV), image build record
RecoverRestore from a clean image, re-enrol the user with fresh AI tool sign-ins, and keep Q1 to Q4 and Q7 running on the host and its peers for 30 days.Endpoint / SOCClean scan, monitoring confirmation
NotifyTell the owners of every cloud account, AI provider organisation and Git organisation the user could reach. If proprietary code or conversations were reachable, involve legal and privacy owners; Check Point notes extortion over exposed conversations is possible.IR lead / LegalNotification log
15

Detection Coverage Map

TechniqueBehaviorCQLIOACrowdStrike coverageSentinelOneDefender XDR
T1071.001 / T1041C2 name resolution and uploadQ1Yes (prevent for 3, detect for 4)GoodGood, with assumptionsGood, with assumptions
T1071.001Raw-IP C2 on 8080 (older builds)Q2, Q6DetectPartialPartial: Q6 approximatePartial: Q6 approximate
T1204.002Known sample runs or landsQ3, Q4IOC (detect)PartialPartial: same limit as CrowdStrikePartial: Q3 telemetry gap, Q4 telemetry gap
T1552.001 / T1528 / T1539AI and cloud credential store sweepQ5NoPartialGAPGAP
T1115 / T1036.005Clipper drop under volume-root VaultQ7DetectPartialPartial: same limit as CrowdStrikePartial: Q7 telemetry gap
T1555.003 / T1555.005Browser and password-manager store theftNoGAPGAPGAP
T1480 / T1497 / T1622Language guard, sandbox and debugger checksNoGAPGAPGAP
T1528 (post-theft)Use of stolen tokens in cloud, AI and Git servicesNoGAPGAPGAP
Initial accessDelivery vector not establishedNoGAPGAPGAP

Gaps in plain terms. Browser and password-manager store reads are opened by their owners constantly and need a per-environment baseline before a query is worth running. In-process checks produce no telemetry. Use of stolen tokens happens outside endpoint telemetry; N4 to N6 cover it where the provider keeps logs. Q5 depends on a file-open event that may be absent; the validation gates in section 11 say how to prove it. A new build will not match a published name or hash, so Q1 to Q4 are strongest for retro-hunting and weakest against fresh builds.

16

Hunt Summary Ticket

TITLE:        Aoki / Aokigahara infostealer targeting AI coding assistant credentials (Symantec, Check Point, October 2026)
SEVERITY:     High. Credential and session theft from developer endpoints; stolen AI, cloud and Git tokens can be abused outside the endpoint
SCOPE:        Windows endpoints that run AI coding tools, cloud CLIs or browsers with saved sessions; every account those tokens reach
HYPOTHESIS:   The stealer runs on a host, sweeps AI-assistant, cloud, browser, wallet and messenger data in one pass, and uploads encrypted ZIP chunks to a /gate endpoint on a small set of domains. Delivery is not established in the reporting.
QUERIES:      7 CQL queries (Q1-Q7). Q1-Q4 high confidence on published indicators; Q5 medium and sensor dependent; Q6 low; Q7 medium. N1-N7 cover proxy, DNS, Sysmon, cloud, provider and identity logs.
DO FIRST:     1) Run Q1-Q4 and Q7 over 90 days. 2) Run N1 and N2 for hosts without a sensor. 3) On any hit: contain, revoke every AI, cloud, Git and browser session, then reimage (runbook section 14).
FINDINGS:     [fill in after the hunt]
GAPS:         Delivery vector, runtime guards, browser and wallet store reads, and the use of stolen tokens are outside endpoint telemetry or not baselined. File-open telemetry may be absent in the tenant.
ACTIONS:      Block 3 corroborated domains; alert on the rest; move secrets out of plaintext config; short token lifetimes; spend caps on AI accounts; canary credentials.
OWNER:        REPLACE_WITH_OWNER
VERSION:      v0.1 (Draft) 2026-10-27
17

Changelog

v0.12026-10-27Initial draft. 7 CQL queries, 4 IOA and IOC rules (3 prevent domains, the rest detect), 7 native hunts, tiered hardening with 5 playbooks. 2 primary sources fetched and saved as snapshots. 176 atomic indicators shipped, parsed from the snapshots by script; no indicator from any other family or cluster included. SentinelOne PowerQuery and Microsoft Defender KQL tabs added to Q1-Q7: SIEM Query Rosetta release 0.1.0 (public-beta; static-reviewed translations).
18

References

TierSourceUsed forAccess date
T1Symantec and Carbon Black Threat Hunter Team: Aoki infostealer targets AI coding assistant credentialsFamily naming, AI-assistant target list, wider target list, /gate endpoint, 17 SHA-256 hashes, 3 C2 domains, attribution unknown.2026-10-27
T1Check Point Research: Infostealer riding the AI Train (2026-10-23)Handler table, aisessions paths, config and C2 protocol, language guard, anti-analysis, SHA-1 hashes, 7 C2 domains, raw IP, YARA string anchors.2026-10-27

Generated 2026-10-27 by HuntPack. Defensive content only.