Golden Chickens / Venom Spider (TAG-195) — TinyEgg, ChonkyChicken & ChromEggscalator

TAG-195 (publicly Golden Chickens / Venom Spider, historically the More_eggs developer) is a financially motivated malware-as-a-service provider whose tooling has been supplied to FIN6, Cobalt Group and Evilnum. On 2026-07-24 Recorded Future's Insikt Group disclosed four new families that replace the prior TerraStealerV2 / TerraLogger generation: TinyEgg (initial-access backdoor), ChonkyChicken (full post-exploitation implant), a modularized ChonkyChicken (controller plus at least fourteen on-demand plugin modules), and ChromEggscalator (a repackaged build of the public ChromElevator Chrome App-Bound-Encryption bypass utility).

The attacker objective is credential and session monetisation. ChonkyChicken does not merely steal saved passwords: it drives a live, authenticated browser through the Chrome DevTools Protocol, so an organisation that rotates passwords after an incident but never looks for an active CDP session remains compromised. Operator TAG-127 delivers the first stage through ClickFix fake-verification pages that talk the user into pasting a command into the Windows Run dialog.

The highest-value defensive angle is that all four families were built to one internal specification, and that specification is behaviourally loud. Every component is an OCX file executed by regsvr32.exe from a user-writable directory, every component gates on its own filename, and TinyEgg and ChonkyChicken both persist through the same Run key value — HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WinComCtl. One behavioural detection on that pattern covers the entire current tool set, present and future, and does not decay when the operators rotate hashes and domains.

Defender priority: deploy Q1 (regsvr32 loading an OCX from a user-writable path) and Q2 (WinComCtl Run-key creation) first — they are high-confidence, low-FP, and durable against the modular redesign. Then run Q3/Q4 for CDP browser hijack, because credential rotation alone does not evict an attacker holding a live DevTools session.

Analyst decisions and corrections

• Correction to the tasking brief — the delivery LOLBIN is regsvr32.exe, not curl/certutil/mshta. The primary report is explicit and consistent across all four families: payloads are OCX files executed via regsvr32.exe. The curl / certutil / mshta trio appears only in CyberPress's own generic "monitor LOLBIN abuse (e.g. ...)" advice, not as an observed TAG-195 artifact. Those binaries are still covered in Q5 as a broad ClickFix net, but they are labelled as generic technique coverage rather than campaign-specific indicators.
• Hash severity capped at detect / high. All 30 SHA256 values originate from the single Insikt appendix; no second independent source publishes them. House rule is that prevent / critical requires two independent sources, so the hashes ship as high-severity detects rather than blocks. The domains, which two sources publish, do ship at prevent.
• 70.34.205.43 deliberately downgraded. Insikt describes it as a shared hosting IP carrying multiple lure domains. Blocking a shared VPS address risks collateral denial, so it ships as detect/high with a note rather than as a block.
• No prompt-injection content found. All six fetched pages were swept for embedded instructions, authority claims and "the real IOCs are here" redirects. The only regex hit was SC Media's copyright boilerplate ("without prior authorization"), which is benign. No source was disqualified.
• Modular ChonkyChicken C2 is a test artifact. The observed endpoint ws://localhost:3000/ws/agent is a development configuration, so the path /ws/agent and the port 3000 are the durable signals — not the loopback address.

Perishability: domains and IPs are volatile (weeks). Hashes are stable but trivially recompiled given the active development cadence. The behavioural signals (regsvr32+OCX, WinComCtl, CDP flags) are the long-lived half of this pack.

Attack chain

Hunt hypotheses (ordered by fidelity)

Every atomic value below is transcribed from the Insikt Group appendix and is traceable to a saved source snapshot. Domains and IPs are shown defanged.

These close gaps the Falcon event stream does not cover — chiefly the non-PE forensic artifacts and the ClickFix paste evidence.

N1 · RunMRU — direct evidence a user pasted a ClickFix command

The Run dialog records everything typed or pasted into it. This is the single best confirmation that a ClickFix lure worked on a specific user, and it survives the process exiting.

reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"

# Sweep a collected hive set for the tell-tale strings (PowerShell, read-only):
Get-ChildItem 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' |
  Select-Object -ExpandProperty Property |
  ForEach-Object { (Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU').$_ } |
  Where-Object { $_ -match 'regsvr32|\.ocx|curl |certutil|mshta|powershell' }

N2 · Forensic log artifacts left by the implants themselves

Both files are written even when execution-gating fails, so they prove an attempt regardless of outcome. Neither is a PE, so Falcon's PE-write events will not surface them.

# ChonkyChicken gating-failure log
Test-Path (Join-Path $env:TEMP 'lg.txt')

# ChromEggscalator operational log
Test-Path 'C:\ProgramData\xlog.txt'

# Staged OCX payloads under the consistent staging root
Get-ChildItem "$env:LOCALAPPDATA\Packages" -Recurse -Filter *.ocx -ErrorAction SilentlyContinue |
  Select-Object FullName, Length, CreationTime

# ChromEggscalator credential-extraction output directory
Get-ChildItem (Join-Path $env:TEMP 'output') -ErrorAction SilentlyContinue

N3 · Proxy / network-inspection hunts

• Search proxy logs for HTTP Upgrade: websocket requests whose URI path ends /ws/agent, on any port.
• Search for outbound TCP/3000 to external addresses. Insikt observed this port across TinyEgg, ChonkyChicken and Modular ChonkyChicken.
• Search for direct-to-IP HTTP/HTTPS (no Host header resolution) — the staging IPs were reachable without domain lookup.
• Look for the proxy_request module's outbound requests: WinHTTP traffic presenting a bare Mozilla/5.0 User-Agent from a workstation process that is not a browser.
• WebSocket payloads are XOR-masked per RFC 6455, so content signatures will not work without frame decoding. Detect on metadata: port, path, Upgrade header, and long-lived connections.

N4 · Windows Security / Directory audit

• Event ID 4698 (scheduled task created) on remote hosts, correlated to a workstation source — ChonkyChicken retains remote scheduled-task strings for lateral movement.
• Event ID 5140 / 5145 (network share accessed) bursts from a single workstation, matching net_share_enum.
• Event ID 4624 Type 3 / Type 9 from workstation-to-workstation, matching cred_exec and token_run.
• Note that remote_logon deliberately enumerates sessions without submitting credentials, so it produces no 4625/4624 at all. Do not treat a quiet auth log as evidence of absence.

Time windows are set in the Falcon console, not in-query. Start with 7 days for the behavioural queries (Q1–Q6, Q11–Q12) and 30 days for the atomic-indicator queries (Q7, Q9, Q10).

// HUNT: regsvr32 loading an OCX from a user-writable directory (TAG-195 execution standard)
// MITRE: T1218.010 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 (Windows process telemetry)
// FALSE POSITIVES: in-house or vendor installers registering an OCX control from %TEMP% during setup
// TUNING: exclude your software-deployment agents by ParentBaseFileName (ccmexec.exe, msiexec.exe, setup.exe)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^regsvr32\.exe$/i
| CommandLine=/\.ocx/i
| CommandLine=/\\(AppData\\Local|AppData\\Roaming|Temp|Downloads|ProgramData|Packages)\\/i
| ParentBaseFileName!=/^(ccmexec\.exe|msiexec\.exe|setup\.exe)$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData])

// HUNT: HKCU Run key named WinComCtl, or any Run value pointing at an OCX
// MITRE: T1547.001 | CONF: high  FP: low  COST: low
// REQUIRES: AsepValueUpdate / RegGenericValueUpdate registry telemetry
// FALSE POSITIVES: legacy line-of-business apps that autostart a genuine OCX control
// TUNING: the WinComCtl arm needs no tuning; for the generic OCX arm, allowlist known-good RegStringValue paths under Program Files
#event_simpleName=/^(AsepValueUpdate|RegGenericValueUpdate)$/
| RegObjectName=/\\Software\\Microsoft\\Windows\\CurrentVersion\\Run$/i
| RegValueName=/^WinComCtl$/i or RegStringValue=/\.ocx/i
| RegStringValue!=/^"?C:\\Program Files/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue])

// HUNT: Chromium browser launched with --remote-debugging-port (CDP listener)
// MITRE: T1185, T1528 | CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2 with CommandLine capture
// FALSE POSITIVES: Selenium / Playwright / Puppeteer test rigs and developer workstations
// TUNING: exclude developer and QA host groups, and exclude ParentBaseFileName of your test runners (node.exe, chromedriver.exe, pwsh.exe on build agents)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(chrome\.exe|msedge\.exe|brave\.exe)$/i
| CommandLine=/--remote-debugging-(port|pipe)/i
| ParentBaseFileName!=/^(node\.exe|chromedriver\.exe|msedgedriver\.exe)$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

// HUNT: browser launched off-screen AND with remote debugging (ChonkyChicken cdp_start)
// MITRE: T1185, T1528 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 with CommandLine capture
// FALSE POSITIVES: none observed -- the off-screen flag is the discriminator
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(chrome\.exe|msedge\.exe|brave\.exe)$/i
| CommandLine=/--window-position=-\d{4,6}/i
| CommandLine=/--(remote-debugging-port|remote-debugging-pipe|user-data-dir)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

// HUNT: ClickFix -- explorer.exe parenting a download/script LOLBIN with remote-content arguments
// MITRE: T1204.004, T1059.003 | CONF: medium  FP: medium  COST: medium
// REQUIRES: ProcessRollup2 with CommandLine and ParentBaseFileName
// FALSE POSITIVES: helpdesk and power users running admin one-liners from Win+R
// TUNING: exclude your IT-admin user group and jump hosts; then baseline the remaining CommandLine values weekly and allowlist recurring internal URLs
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^explorer\.exe$/i
| FileName=/^(cmd\.exe|powershell\.exe|pwsh\.exe|mshta\.exe|wscript\.exe|cscript\.exe|curl\.exe|certutil\.exe|regsvr32\.exe|bitsadmin\.exe)$/i
| CommandLine=/(http|\.ocx|iwr |invoke-webrequest|-urlcache|-encodedcommand|-w hidden|downloadstring)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

// HUNT: TinyEgg / ChonkyChicken / ChromEggscalator / modular-controller OCX staged to disk
// MITRE: T1105 | CONF: high  FP: low  COST: low
// REQUIRES: PeFileWritten / NewExecutableWritten file telemetry
// FALSE POSITIVES: genuine mscomctl.ocx shipped by legacy VB6-era installers -- excluded by the path filter below
// TUNING: if a legacy LOB installer trips this, allowlist its exact TargetFileName rather than removing the filename arm
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| TargetFileName=/\\(updater|mscomctl|mscom|chromelevator|koki|agent|wpad_capture)\.ocx$/i
| TargetFileName=/\\(AppData|Temp|Downloads|ProgramData|Packages)\\/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA256HashData])

// HUNT: known TAG-195 sample hashes (Insikt Group appendix, 2026-07-24)
// MITRE: T1218.010, T1105 | CONF: high  FP: low  COST: low
// REQUIRES: process or PE-write telemetry carrying SHA256HashData
// FALSE POSITIVES: none -- any match is confirmed TAG-195 tooling
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| in(SHA256HashData, values=[
    "b7b322f4638ead5c39031ffc7ca8c791c8d47211b09449f7ceb49f0c32a19b45",
    "33a12c2328db22429c4a515400a57ffeaf7aec48a2a3c299ab6f1ce2d2b0e87d",
    "7ee371ff1a13a3bbd26c925a9beedb1aa0d0c03fe6f63d3803a3a55aaccd0a5b",
    "6922b319dc96d020738bcf466c4d6d9233e4767b68592e1fd9258a232f166ce1",
    "086273cd91f3d6556ed2af915df310e4b184b3db84c3903aa09830d49d1fbb62",
    "652346c05123b4c9556c27f5c5efc4bcd941dd66957e3797c6751246a2bff9c6",
    "f3f4de7eb30c01044ad3c7f2c22376d0ab6f6dc60ef6aee3cde75fd33fbddacc",
    "6c23b7723a9f69ea48f02c8fe13fd60ecbfc2fb28e32e481c46ec968a66c66cd",
    "c455c02ca6b3844027e05d941830de97753c3966dd57c5fa9f1938d8cd1cca3b",
    "d2e1ab10d5a0c16a724aeda8acb46b38f551ade58137969c3bc3c9cdc0a12425",
    "3250adbca0a0bfeab8bd88ee93b603be31fc86b341fd77a152b4843416560d53",
    "5cae5202ddcc29f19f954d81ba138f11b8a4080d05fef63c05a00b9242c06967",
    "ccb6be9211b3946d290e8b23497b8f0e6ac045d1dcde4aaae424680e9029e4eb",
    "200fbc76bd9fab3b4adcecfe44233cf47146f5709a9735a0232cb4aa7284eadb",
    "5d585f2b24503a96011bbe928f42b1b663946e822b309f8496573c66b5ee834c",
    "9a2d714ddd5c48722c35df8a70e97f12d46bcde05dc79b7242a7e692bd346826",
    "d5dea9a51b984be9d7fa76e3e8ff89cfb97c335927331e8e348b9ee269070c1b",
    "c4e2af286ee2ed12375bb66a5bff1a9d3bb5a6579842bc3a28ac00dfae195adc",
    "a3a0aced0f3c13b0b9890ec74802a1cb4936bccfaf5e8a6a52f555c82e09d92f",
    "f3d2ad7440a6f985846710d2dcf0dd2db268dc690837bdf19e4e4e6684483527",
    "6c7619c34497f430c4f7618cfefe07d1defacfae48f6730c20f52e7a7344faa9",
    "41aa04782e436345ef45dc159321d5c0e0e5cba300e55a4d1d3194e5c7c5fd97",
    "337e92c233edc38842c6122fa38e0e84a478f5aa5af2a95ca6be3ca056d925b8",
    "c4e55e9e6837de01f0dadc7db299abd48630bf115a442f09ea0c6a593c559e6f",
    "6adf68448b8541e3cbe4a471845cb6c2ac07613f08698567e5ed76dc2a921834",
    "be7b80f42b0d859b7afaeefca04e46dc10fb5c0a532692bbbfef2924254d1175",
    "45c8cbaeb5c7708e7b8030e701747c65203958e82eddc41f39e0ca93bd36c114",
    "e481d16e51f90c4cc0e7096284b53eef06f7ee8b37a03d92734521d8bca24409",
    "e3153ced59bb0376186b0eee0ec68f0b5aa9ae5820ef8508ae4e67625e1a3581",
    "16735cb80d796865b2430aa11d21a539fcb00b027932f2c63e4b5c098d26585b"])
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, SHA256HashData])

// HUNT: workstation egress to TCP/3000 (TAG-195 WebSocket C2 listener port)
// MITRE: T1071.001, T1571 | CONF: medium  FP: medium  COST: low
// REQUIRES: NetworkConnectIP4 telemetry
// FALSE POSITIVES: Node.js dev servers, Grafana, internal microservices on the default 3000 port
// TUNING: this query already drops RFC1918 destinations; additionally exclude your developer host group and any SaaS vendor ranges you legitimately reach on 3000
#event_simpleName=/^NetworkConnectIP4$/
| RemotePort=3000
| RemoteAddressIP4!=/^(10\.|127\.|169\.254\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort])

// HUNT: TAG-195 / TAG-127 lure and C2 domain resolution
// MITRE: T1189, T1071.001 | CONF: high  FP: low  COST: low
// REQUIRES: DnsRequest telemetry
// FALSE POSITIVES: internal threat-intel scanners and sandbox detonation hosts resolving IOCs on purpose
#event_simpleName=/^(DnsRequest|SuspiciousDnsRequest)$/
| DomainName=/(^|\.)(aurekh\.com|ahdaratlegalservices\.com|screenly\.cam|paysolutions\.ink|xtrafftrck\.net|trackgrid\.net)$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, DomainName])

// HUNT: outbound connections to published TAG-195 staging / C2 addresses
// MITRE: T1071.001 | CONF: high  FP: low  COST: low
// REQUIRES: NetworkConnectIP4 telemetry
// FALSE POSITIVES: 70.34.205.43 is SHARED hosting -- a hit is not proof of TAG-195 contact on its own
#event_simpleName=/^NetworkConnectIP4$/
| in(RemoteAddressIP4, values=["70.34.205.43", "65.20.102.161", "65.20.105.177", "108.61.209.100"])
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort])

// HUNT: regsvr32/rundll32 making wide internal connection fan-out (network reconnaissance)
// MITRE: T1046, T1018 | CONF: medium  FP: medium  COST: medium
// REQUIRES: NetworkConnectIP4 telemetry with ContextBaseFileName populated
// FALSE POSITIVES: scanners and asset-discovery agents that inject into or masquerade as COM hosts
// TUNING: exclude the aid values of your authorised vulnerability scanners and asset-discovery servers, then raise the DistinctHosts floor until only outliers remain
#event_simpleName=/^NetworkConnectIP4$/
| ContextBaseFileName=/^(regsvr32\.exe|rundll32\.exe)$/i
| groupBy([aid, ComputerName, ContextBaseFileName], function=[count(field=RemoteAddressIP4, distinct=true, as=DistinctHosts), count(field=RemotePort, distinct=true, as=DistinctPorts)])
| DistinctHosts > 25
| sort(DistinctHosts, order=desc, limit=100)

// HUNT: local CDP endpoint (9222) contacted by a process that is not a browser
// MITRE: T1185, T1528 | CONF: medium  FP: medium  COST: low
// REQUIRES: NetworkConnectIP4 including loopback -- verify loopback retention in tenant
// FALSE POSITIVES: chromedriver, node, VS Code and other developer tooling attaching to a debug port
// TUNING: exclude ContextBaseFileName of your sanctioned dev tooling (node.exe, chromedriver.exe, code.exe) and your developer host group
#event_simpleName=/^NetworkConnectIP4$/
| RemotePort=9222
| ContextBaseFileName!=/^(chrome\.exe|msedge\.exe|brave\.exe|node\.exe|chromedriver\.exe|msedgedriver\.exe|code\.exe)$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort])

Three queries are strong enough to promote from Investigate-only to a blocking Custom IOA. The rest stay as scheduled hunt searches.

IOA-1 · Block regsvr32 registering an OCX from a user-writable path

IOA-2 · Alert on WinComCtl Run-key creation

IOA-3 · Alert on off-screen debuggable browser launch

Investigate-only (do not promote): Q5, Q8, Q11 and Q12 carry medium FP risk and are environment-sensitive. Run them as scheduled searches with the tuning applied, review for two weeks, and only then consider promotion. Q7/Q9/Q10 belong in Falcon IOC Management rather than a Custom IOA.

Every atomic value below is traceable to a saved source snapshot. Behavioural signatures are deliberately kept separate from importable indicators.

type,value,action,severity,expiration,description,tags
domain,aurekh.com,prevent,high,2027-01-27,TAG-195 ClickFix lure domain,campaign:TAG-195
domain,ahdaratlegalservices.com,prevent,high,2027-01-27,TAG-195 ClickFix lure domain,campaign:TAG-195
domain,screenly.cam,prevent,high,2027-01-27,TAG-195 ClickFix lure domain,campaign:TAG-195
domain,paysolutions.ink,prevent,high,2027-01-27,TAG-195 ClickFix lure domain,campaign:TAG-195
domain,xtrafftrck.net,prevent,high,2027-01-27,TAG-195 OCX staging and WebSocket C2,campaign:TAG-195
domain,thessa.trackgrid.net,prevent,high,2027-01-27,TAG-195 OCX staging and WebSocket C2,campaign:TAG-195
ipv4,70.34.205.43,detect,high,2027-01-27,SHARED hosting IP for lure domains - do not block,campaign:TAG-195
ipv4,65.20.102.161,detect,high,2027-01-27,TAG-195 OCX staging and WebSocket C2,campaign:TAG-195
ipv4,65.20.105.177,detect,high,2027-01-27,TAG-195 OCX staging and WebSocket C2,campaign:TAG-195
ipv4,108.61.209.100,detect,high,2027-01-27,TAG-195 OCX staging and WebSocket C2,campaign:TAG-195
sha256,b7b322f4638ead5c39031ffc7ca8c791c8d47211b09449f7ceb49f0c32a19b45,detect,high,2027-01-27,ChromEggscalator,campaign:TAG-195
sha256,33a12c2328db22429c4a515400a57ffeaf7aec48a2a3c299ab6f1ce2d2b0e87d,detect,high,2027-01-27,ChromEggscalator,campaign:TAG-195
sha256,7ee371ff1a13a3bbd26c925a9beedb1aa0d0c03fe6f63d3803a3a55aaccd0a5b,detect,high,2027-01-27,ChromEggscalator,campaign:TAG-195
sha256,6922b319dc96d020738bcf466c4d6d9233e4767b68592e1fd9258a232f166ce1,detect,high,2027-01-27,ChromEggscalator,campaign:TAG-195
sha256,086273cd91f3d6556ed2af915df310e4b184b3db84c3903aa09830d49d1fbb62,detect,high,2027-01-27,TinyEgg,campaign:TAG-195
sha256,652346c05123b4c9556c27f5c5efc4bcd941dd66957e3797c6751246a2bff9c6,detect,high,2027-01-27,TinyEgg,campaign:TAG-195
sha256,f3f4de7eb30c01044ad3c7f2c22376d0ab6f6dc60ef6aee3cde75fd33fbddacc,detect,high,2027-01-27,TinyEgg,campaign:TAG-195
sha256,6c23b7723a9f69ea48f02c8fe13fd60ecbfc2fb28e32e481c46ec968a66c66cd,detect,high,2027-01-27,TinyEgg,campaign:TAG-195
sha256,c455c02ca6b3844027e05d941830de97753c3966dd57c5fa9f1938d8cd1cca3b,detect,high,2027-01-27,TinyEgg,campaign:TAG-195
sha256,d2e1ab10d5a0c16a724aeda8acb46b38f551ade58137969c3bc3c9cdc0a12425,detect,high,2027-01-27,TinyEgg,campaign:TAG-195
sha256,3250adbca0a0bfeab8bd88ee93b603be31fc86b341fd77a152b4843416560d53,detect,high,2027-01-27,TinyEgg,campaign:TAG-195
sha256,5cae5202ddcc29f19f954d81ba138f11b8a4080d05fef63c05a00b9242c06967,detect,high,2027-01-27,TinyEgg,campaign:TAG-195
sha256,ccb6be9211b3946d290e8b23497b8f0e6ac045d1dcde4aaae424680e9029e4eb,detect,high,2027-01-27,TinyEgg,campaign:TAG-195
sha256,200fbc76bd9fab3b4adcecfe44233cf47146f5709a9735a0232cb4aa7284eadb,detect,high,2027-01-27,ChonkyChicken (Insikt Sigma reference sample),campaign:TAG-195
sha256,5d585f2b24503a96011bbe928f42b1b663946e822b309f8496573c66b5ee834c,detect,high,2027-01-27,ChonkyChicken,campaign:TAG-195
sha256,9a2d714ddd5c48722c35df8a70e97f12d46bcde05dc79b7242a7e692bd346826,detect,high,2027-01-27,ChonkyChicken,campaign:TAG-195
sha256,d5dea9a51b984be9d7fa76e3e8ff89cfb97c335927331e8e348b9ee269070c1b,detect,high,2027-01-27,ChonkyChicken,campaign:TAG-195
sha256,c4e2af286ee2ed12375bb66a5bff1a9d3bb5a6579842bc3a28ac00dfae195adc,detect,high,2027-01-27,ChonkyChicken,campaign:TAG-195
sha256,a3a0aced0f3c13b0b9890ec74802a1cb4936bccfaf5e8a6a52f555c82e09d92f,detect,high,2027-01-27,ChonkyChicken,campaign:TAG-195
sha256,f3d2ad7440a6f985846710d2dcf0dd2db268dc690837bdf19e4e4e6684483527,detect,high,2027-01-27,ChonkyChicken,campaign:TAG-195
sha256,6c7619c34497f430c4f7618cfefe07d1defacfae48f6730c20f52e7a7344faa9,detect,high,2027-01-27,ChonkyChicken,campaign:TAG-195
sha256,41aa04782e436345ef45dc159321d5c0e0e5cba300e55a4d1d3194e5c7c5fd97,detect,high,2027-01-27,ChonkyChicken,campaign:TAG-195
sha256,337e92c233edc38842c6122fa38e0e84a478f5aa5af2a95ca6be3ca056d925b8,detect,high,2027-01-27,ChonkyChicken,campaign:TAG-195
sha256,c4e55e9e6837de01f0dadc7db299abd48630bf115a442f09ea0c6a593c559e6f,detect,high,2027-01-27,ChonkyChicken,campaign:TAG-195
sha256,6adf68448b8541e3cbe4a471845cb6c2ac07613f08698567e5ed76dc2a921834,detect,high,2027-01-27,ChonkyChicken,campaign:TAG-195
sha256,be7b80f42b0d859b7afaeefca04e46dc10fb5c0a532692bbbfef2924254d1175,detect,high,2027-01-27,ChonkyChicken,campaign:TAG-195
sha256,45c8cbaeb5c7708e7b8030e701747c65203958e82eddc41f39e0ca93bd36c114,detect,high,2027-01-27,ChonkyChicken,campaign:TAG-195
sha256,e481d16e51f90c4cc0e7096284b53eef06f7ee8b37a03d92734521d8bca24409,detect,high,2027-01-27,ChonkyChicken,campaign:TAG-195
sha256,e3153ced59bb0376186b0eee0ec68f0b5aa9ae5820ef8508ae4e67625e1a3581,detect,high,2027-01-27,Modular ChonkyChicken controller,campaign:TAG-195
sha256,16735cb80d796865b2430aa11d21a539fcb00b027932f2c63e4b5c098d26585b,detect,high,2027-01-27,Modular ChonkyChicken controller,campaign:TAG-195
# Hashes ship as detect/high rather than prevent/critical: all 30 come from one
# vendor appendix, and house rule requires two independent sources for prevent.
# Domains carry two sources and therefore ship at prevent.

TAG-195 behavioural signatures (no atomic value required)

BEH-1  regsvr32.exe command line contains ".ocx" AND a user-writable path
       (%TEMP% | %APPDATA% | %LOCALAPPDATA% | %LOCALAPPDATA%\Packages\ | Downloads | %ProgramData%)
BEH-2  HKCU\Software\Microsoft\Windows\CurrentVersion\Run value named "WinComCtl"
BEH-3  HKCU ...\CurrentVersion\Run value data referencing any .ocx outside Program Files
BEH-4  chrome.exe|msedge.exe launched with --remote-debugging-port
       AND --window-position=-32000,-32000   (off-screen CDP session)
BEH-5  explorer.exe parenting cmd|powershell|mshta|curl|certutil|regsvr32
       with remote-content arguments   (ClickFix Run-dialog paste)
BEH-6  Outbound TCP/3000 to a non-RFC1918 address from a workstation
BEH-7  HTTP Upgrade: websocket with URI path ending /ws/agent  (any port)
BEH-8  Non-browser process connecting to 127.0.0.1:9222
BEH-9  File present: %TEMP%\lg.txt          (ChonkyChicken gating log)
BEH-10 File present: C:\ProgramData\xlog.txt  (ChromEggscalator log)
BEH-11 Directory present: %TEMP%\output\      (ChromEggscalator extraction output)
BEH-12 WinHTTP request with a bare "Mozilla/5.0" User-Agent from a non-browser process
BEH-13 regsvr32.exe or rundll32.exe opening connections to many distinct internal hosts

Families      TinyEgg | ChonkyChicken | Modular ChonkyChicken | ChromEggscalator
Predecessors  More_eggs | RevC2 | TerraStealerV2 | TerraLogger | VenomLNK
Actors        TAG-195 (Golden Chickens / Venom Spider) = developer
              TAG-127 = operator/customer using ClickFix and VenomLNK
Customers     FIN6 | Cobalt Group | Evilnum   (per prior eSentire reporting)

OCX filenames        updater.ocx        TinyEgg gating token
                     mscomctl.ocx       ChonkyChicken masquerade (collides with a real MS control)
                     mscom.ocx          ChromEggscalator staged into %TEMP%
                     chromelevator.ocx  ChromEggscalator gating token
                     koki.ocx           Modular ChonkyChicken controller
                     agent.ocx          Modular ChonkyChicken controller (alt)
                     wpad_capture.ocx   WPAD hash-capture helper (never recovered)

Staging path         %LOCALAPPDATA%\Packages\
Run key              HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WinComCtl
Persistence cmd      regsvr32 /s /i "<staged_path>"
Exports used         DllInstall (TinyEgg, ChonkyChicken, modular controller)
                     DllRegisterServer (ChromEggscalator, WPAD helper)
Debug strings        Koki=[YES/NO]  Blat=[YES/NO]   (gating result markers)
C2 protocol          JSON over WebSocket; register = request_register / agent_register
                     agentType "tiny" = TinyEgg
Modules (14)         procmgr screen files shell network domain clipboard keylog
                     wtrack audio idle proxy chrome persist
                     (wtrack purpose is undetermined -- capability under development)

# 1. Is regsvr32 already blocked from user-writable paths? (WDAC/AppLocker)
Get-AppLockerPolicy -Effective -Xml | Select-String -Pattern 'regsvr32|\.ocx'

# 2. ASR rule: block Office/script-created executable content
#    (BlockExecutableContent) - report current state
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions

# 3. Is the Run dialog restricted for standard users?
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun

# 4. Is browser password saving disabled by policy?
reg query "HKLM\Software\Policies\Google\Chrome" /v PasswordManagerEnabled
reg query "HKLM\Software\Policies\Microsoft\Edge" /v PasswordManagerEnabled

# 5. Is remote debugging blocked by browser policy?
reg query "HKLM\Software\Policies\Google\Chrome" /v RemoteDebuggingAllowed
reg query "HKLM\Software\Policies\Microsoft\Edge" /v RemoteDebuggingAllowed

# 6. PowerShell language mode for standard users
$ExecutionContext.SessionState.LanguageMode

# 7. Is outbound TCP/3000 permitted from workstation VLANs?
#    (check at the egress firewall, not on the host)

Playbook 1 — AppLocker DLL rule blocking OCX/DLL execution from user-writable paths

Prerequisites: AppLocker requires the Application Identity service (AppIDSvc) running and set to automatic. Windows Enterprise/Education, or Windows Pro with WDAC instead. An existing AppLocker DLL rule collection, or acceptance that creating one enables DLL rule enforcement estate-wide. Test in Audit mode on a pilot ring first — DLL rules are the highest-compatibility-risk AppLocker collection.
Reboot required: No. A Group Policy refresh (gpupdate /force) plus a user logoff/logon is sufficient.
Rollback: Delete the DLL rule collection from the GPO and run gpupdate /force, or set -RuleType DLL enforcement back to NotConfigured. Local fallback is shown in step 5. No file or registry state is left behind.

# --- Step 1: confirm the Application Identity service is running -------------
Get-Service AppIDSvc | Select-Object Name, Status, StartType
Set-Service AppIDSvc -StartupType Automatic
Start-Service AppIDSvc

# --- Step 2: start in AUDIT mode. Do not skip this. -------------------------
Set-AppLockerPolicy -XmlPolicy .\tag195-dll-audit.xml -Merge

# tag195-dll-audit.xml -- DLL collection, AuditOnly:
#   <RuleCollection Type="Dll" EnforcementMode="AuditOnly">
#     <FilePathRule Id="..." Name="Allow DLL/OCX from Program Files"
#                   UserOrGroupSid="S-1-1-0" Action="Allow">
#       <Conditions><FilePathCondition Path="%PROGRAMFILES%\*"/></Conditions>
#     </FilePathRule>
#     <FilePathRule Id="..." Name="Allow DLL/OCX from Windows"
#                   UserOrGroupSid="S-1-1-0" Action="Allow">
#       <Conditions><FilePathCondition Path="%WINDIR%\*"/></Conditions>
#     </FilePathRule>
#   </RuleCollection>
# Everything outside those two roots is implicitly denied, which covers
# %TEMP%, %APPDATA%, %LOCALAPPDATA%\Packages\, Downloads and %ProgramData%.

# --- Step 3: harvest audit events for 7-14 days -----------------------------
Get-WinEvent -LogName 'Microsoft-Windows-AppLocker/EXE and DLL' -MaxEvents 2000 |
  Where-Object { $_.Id -eq 8003 } |
  Select-Object TimeCreated, Message | Format-List

# --- Step 4: promote to Enforce only after the audit log is clean -----------
# Change EnforcementMode="AuditOnly" to EnforcementMode="Enabled", re-import:
Set-AppLockerPolicy -XmlPolicy .\tag195-dll-enforce.xml -Merge

# --- Step 5: ROLLBACK (local) -----------------------------------------------
# Clears the local AppLocker policy entirely and returns to no DLL enforcement.
Set-AppLockerPolicy -XmlPolicy .\empty-policy.xml
gpupdate /force
# Domain rollback: remove the DLL RuleCollection from the GPO, then gpupdate.

# --- Step 6: verify ---------------------------------------------------------
Get-AppLockerPolicy -Effective -Xml | Select-String -Pattern 'Dll|EnforcementMode'

Playbook 2 — Browser policy: kill password storage and remote debugging

Prerequisites: Chrome and/or Edge ADMX templates imported into the Central Store, or direct registry deployment via GPO Preferences / Intune. Users must be warned that saved passwords will become unavailable — pair this with an enterprise password manager rollout or you will generate a helpdesk surge.
Reboot required: No. Browser restart required for the policy to take effect.
Rollback: Delete the four registry values shown in step 4 (or set the GPO settings to Not Configured) and restart the browser. Previously saved passwords are not deleted by this policy, only prevented from being added, so rollback restores prior behaviour without data loss.

# --- Step 1: Chrome -- disable password manager and remote debugging --------
New-Item -Path 'HKLM:\Software\Policies\Google\Chrome' -Force | Out-Null
Set-ItemProperty -Path 'HKLM:\Software\Policies\Google\Chrome' `
  -Name 'PasswordManagerEnabled' -Value 0 -Type DWord
Set-ItemProperty -Path 'HKLM:\Software\Policies\Google\Chrome' `
  -Name 'RemoteDebuggingAllowed' -Value 0 -Type DWord

# --- Step 2: Edge -- same two controls --------------------------------------
New-Item -Path 'HKLM:\Software\Policies\Microsoft\Edge' -Force | Out-Null
Set-ItemProperty -Path 'HKLM:\Software\Policies\Microsoft\Edge' `
  -Name 'PasswordManagerEnabled' -Value 0 -Type DWord
Set-ItemProperty -Path 'HKLM:\Software\Policies\Microsoft\Edge' `
  -Name 'RemoteDebuggingAllowed' -Value 0 -Type DWord

# --- Step 3: verify ---------------------------------------------------------
Get-ItemProperty 'HKLM:\Software\Policies\Google\Chrome'   |
  Select-Object PasswordManagerEnabled, RemoteDebuggingAllowed
Get-ItemProperty 'HKLM:\Software\Policies\Microsoft\Edge'  |
  Select-Object PasswordManagerEnabled, RemoteDebuggingAllowed
# Also confirm in-browser at chrome://policy and edge://policy

# --- Step 4: ROLLBACK -------------------------------------------------------
Remove-ItemProperty -Path 'HKLM:\Software\Policies\Google\Chrome' `
  -Name 'PasswordManagerEnabled','RemoteDebuggingAllowed' -ErrorAction SilentlyContinue
Remove-ItemProperty -Path 'HKLM:\Software\Policies\Microsoft\Edge' `
  -Name 'PasswordManagerEnabled','RemoteDebuggingAllowed' -ErrorAction SilentlyContinue
# Restart the browser. Saved credentials are untouched by this policy.

Playbook 3 — Restrict the Run dialog for standard users (ClickFix mitigation)

Prerequisites: Identify and exempt every group that legitimately uses Win+R — helpdesk, desktop engineering, developers. This is a user-visible change and will generate tickets if deployed estate-wide without notice. Deploy via a GPO scoped to standard users only, never to an OU containing admin accounts.
Reboot required: No. Logoff/logon or gpupdate /force plus an Explorer restart.
Rollback: Set NoRun to 0 or delete the value, then restart Explorer (step 3). Immediate and complete — the Run dialog returns with no residual state.

# --- Step 1: apply (per-user; deploy via GPO scoped to standard users) ------
$k = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'
New-Item -Path $k -Force | Out-Null
Set-ItemProperty -Path $k -Name 'NoRun' -Value 1 -Type DWord

# --- Step 2: verify ---------------------------------------------------------
Get-ItemProperty -Path $k -Name NoRun

# --- Step 3: ROLLBACK -------------------------------------------------------
Remove-ItemProperty -Path $k -Name 'NoRun' -ErrorAction SilentlyContinue
Stop-Process -Name explorer -Force   # Explorer restarts automatically

# --- Step 4: compensating hunt while this is still being piloted ------------
# Until NoRun is deployed, Q5 plus the RunMRU sweep (N1) are the coverage.
# Note that NoRun does NOT block PowerShell/Terminal paste-and-run, so
# ClickFix variants targeting a terminal window remain in scope for Q5.

Playbook 4 — Egress control for WebSocket C2

Prerequisites: A change window at the egress firewall and an inventory of any business application legitimately reached on TCP/3000. Confirm with Q8 (run in report mode over 30 days) before writing the deny rule, or you will break something you did not know existed.
Reboot required: No. Firewall policy commit only.
Rollback: Remove the deny rule and re-commit. Keep the previous policy version tagged so the rollback is a single revert rather than a hand-rebuild. Because this is a deny rule with no state change on endpoints, rollback is immediate and has no side effects.

# --- Step 1: evidence-gather BEFORE writing the rule ------------------------
# Run Q8 with the RFC1918 exclusion removed, over 30 days, and list every
# distinct RemoteAddressIP4 + ContextBaseFileName pair. That is your exemption
# candidate list. Do not guess it.

# --- Step 2: firewall policy (vendor-neutral intent) ------------------------
#   deny  src: workstation-VLANs   dst: any   port: tcp/3000   log: yes
#   allow src: workstation-VLANs   dst: <named business hosts>  port: tcp/3000
#   (place the allow ABOVE the deny; scope it by destination, never "any")

# --- Step 3: also deny direct-to-IP HTTP/S from workstation VLANs -----------
#   Force all workstation web egress through the authenticated proxy.
#   This is what closes the DNS-less staging path (M-Near-3).

# --- Step 4: verify ---------------------------------------------------------
# From a pilot workstation, attempt an outbound TCP/3000 connection to an
# external test listener and confirm it is denied AND logged.
Test-NetConnection -ComputerName <external-test-host> -Port 3000

# --- Step 5: ROLLBACK -------------------------------------------------------
# Revert to the tagged previous policy version and re-commit. No endpoint
# state was changed, so nothing else needs undoing.

Documented gaps

• G1 · Filename gating and string obfuscation are not endpoint-detectable. These are anti-analysis properties, not runtime behaviours. Their practical effect is that dynamic sandboxing of a captured sample will silently produce a clean verdict. Compensate by treating the presence of %TEMP%\lg.txt (N2) as evidence of an attempt, and never clear a sample as benign purely because it did not detonate.
• G2 · Modular plugin capabilities have no reliable telemetry. Modules arrive Base64-encoded over the WebSocket, are written to a randomly named temp file and loaded via LoadLibraryA. There is no stable filename, hash or path to hunt. This is the single largest gap in the pack and it is by design — Insikt notes a defender who captures the controller captures no capabilities at all. Detection must be pushed upstream to the controller (Q1, Q2, Q6, Q8), which is why those four queries carry the weight of this pack.
• G3 · remote_logon generates no authentication events. It enumerates logged-on sessions without submitting credentials, so there is nothing in the Security log to find. Accept as uncovered; compensate with M-Near-4 (east-west restriction) so the reconnaissance has less to feed.
• G4 · WebSocket content is opaque. RFC 6455 mandates XOR frame masking, so content signatures do not work without frame decoding (M-Strat-5). Coverage is metadata-only: port, path, Upgrade header, connection duration.
• G5 · ARP-based host discovery is link-layer. net_arp_scan is largely invisible to EDR and to L3 network monitoring. Q11 catches the TCP half of net_enumerate only. Switch-level ARP monitoring would be required for full coverage.
• G6 · Non-PE forensic artifacts. lg.txt, xlog.txt and the %TEMP%\output\ directory are not PE files, so Falcon's PE-write events do not surface them. Covered by native hunt N2 as a host-triage step rather than by streamed telemetry.

Validation gates: the eight gates in §11 must be cleared before any of this coverage counts as deployed. In particular, gate G-1 determines whether Q2 is live at all (it is blind without AsepValueUpdate), and gate G-2 determines whether Q12 is coverage or a seventh gap. Run gates G-4 through G-7 as the purple-team exercise Recorded Future recommends — every one of them uses benign components and no malicious code.

Source snapshots for every reference above are archived alongside this pack in GoldenChickens-TAG195-TinyEgg-Hunt-sources/. Every atomic indicator shipped in §10 is mechanically traceable to one of those snapshots.