TamperedChef (EvilAI) — Signed Fake-Productivity-App Malvertising

Looks for: the known TamperedChef app binaries running from %LocalAppData%/user paths. Accomplishes: directly identifies installed fake apps. FP: none for the named binaries; extend the list as Unit 42 adds variants.

// HUNT: TamperedChef fake productivity app execution
// MITRE: T1204.002, T1553.002 | CONF: high  FP: low-med  COST: low
// TUNING: extend the name list as new variants are published (Unit 42 cluster tracking)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (FileName=/^(AppSuite|Calendaromatic|OneZip|CrystalPDF|PDFEditor|Manual-Finder)\.exe$/i
   or CommandLine=/(AppSuite|Calendaromatic|OneZip|CrystalPDF)/i)
| ImageFileName=/\\(AppData|ProgramData|Temp|Program Files)\\/i
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, SHA256HashData], limit=200)

Looks for: a scheduled task registered that points at an Electron binary in a user-writable path. Accomplishes: catches the persistence/timing mechanism even before the payload activates.

// HUNT: TamperedChef scheduled-task persistence (Electron binary in user path)
// MITRE: T1053.005 | CONF: high  FP: low-med  COST: low
// TUNING: correlate to Q1; legit apps also use tasks — focus on AppData/Temp targets
#event_simpleName=ScheduledTaskRegistered
| (CommandLine=/(AppSuite|Calendaromatic|OneZip|CrystalPDF)/i
   or CommandLine=/\\(AppData|Temp|ProgramData)\\.+\.exe/i)
| table([@timestamp, ComputerName, UserName, TaskName, CommandLine], limit=200)

Looks for: first outbound connection from a known fake-app binary. Accomplishes: catches the activation beacon. FP: normal app telemetry — scope to the named binaries and run a 60–90 day window.

// HUNT: TamperedChef activation beacon (run over 60-90 days for the ~56-day delay)
// MITRE: T1071.001, T1497.003 | CONF: medium  FP: medium  COST: medium
// TUNING: scope to the named binaries; exclude legitimate vendor update endpoints
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^(AppSuite|Calendaromatic|OneZip|CrystalPDF|PDFEditor)\.exe$/i
| RemoteAddressIP4!=/^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.|127\.)/
| table([@timestamp, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], limit=200)

Looks for: registry writes to browser search/homepage/extension keys by a user-path binary. Accomplishes: catches the browser-hijack payload. FP: legit browser config tools — correlate with Q1.

// HUNT: TamperedChef browser hijack (search/homepage/extension)
// MITRE: T1176, T1112 | CONF: medium  FP: medium  COST: low
// TUNING: correlate to Q1; allow-list sanctioned browser-management tooling
#event_simpleName=/AsepValueUpdate|RegGenericValueUpdate/
| RegObjectName=/\\(Software\\Policies\\(Google|Microsoft|Mozilla)|Chrome\\Extensions|Edge\\Extensions|Main\\Start Page|DefaultScope)/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegStringValue], limit=200)

Looks for: a fake-app binary spawning a shell/script host or a freshly-written executable. Accomplishes: catches the RAT/stealer second stage. FP: low for the named apps.

// HUNT: TamperedChef second-stage payload (child of the fake app)
// MITRE: T1059, T1105 | CONF: high  FP: low-med  COST: low
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(AppSuite|Calendaromatic|OneZip|CrystalPDF|PDFEditor)\.exe$/i
| FileName=/^(cmd|powershell|pwsh|mshta|wscript|cscript|rundll32|regsvr32)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Looks for: binaries signed by a known TamperedChef shell-company certificate (populate from Unit 42 cluster reporting). Accomplishes: a powerful cert-reuse pivot across all variants. FP: depends on signer telemetry; only as good as the cert list you maintain.

// HUNT: TamperedChef cert-reuse pivot (shell-company signer)
// MITRE: T1553.002 | CONF: medium  FP: medium  COST: low
// REQUIRES: PE signer telemetry; populate the subject/thumbprint list from Unit 42 reporting
// TUNING: populate the signer subject list from the cited reporting before running -- the REPLACE_WITH placeholder matches nothing, so this query silently returns zero rows until it is filled in. Once populated, pivot on the thumbprint rather than the subject string, which shell companies re-register.
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CertificateSubject=/REPLACE_WITH_SHELL_COMPANY_SUBJECT(S)/i
| table([@timestamp, ComputerName, FileName, ImageFileName, CertificateSubject, SHA256HashData], limit=200)