Aokigahara / Kamidere / Stygian AI-Tool Infostealer Wave: OTX Pulse Detection Pack

---
title: AI Developer Tool Credential Store Access By Suspicious Process
id: 9d0a1f5a-6d8d-4f3f-9b2f-aokigahara-ai-0001
status: experimental
description: Detects suspicious processes accessing AI assistant or developer-tool token/config locations associated with Aokigahara-style infostealer targeting.
author: Security Arsenal Detection Engineering
date: 2026/10/26
references:
  - https://research.checkpoint.com/2026/infostealer-riding-the-ai-train/
logsource:
  category: file_event
  product: windows
detection:
  selection_target:
    TargetFilename|contains:
      - 'Claude'
      - 'ChatGPT'
      - 'Codex'
      - 'Cursor'
      - 'Windsurf'
      - 'Copilot'
      - 'Gemini'
      - 'git-credentials'
      - 'Login Data'
      - 'Cookies'
      - 'Web Data'
  selection_process:
    Image|contains:
      - 'powershell'
      - 'pwsh'
      - 'rundll32'
      - 'regsvr32'
      - 'wscript'
      - 'cscript'
      - 'mshta'
      - 'python'
      - 'node'
      - '7z'
      - 'rar'
      - 'curl'
      - 'wget'
  condition: selection_target and selection_process
falsepositives:
  - Legitimate IDE sync, browser updates, backup agents, developer automation.
level: high
tags:
  - attack.credential_access
  - attack.t1555
  - attack.t1539
  - attack.t1005
---
title: Aokigahara Campaign Network Beacon Or Exfiltration
id: 7d42a2d0-2d1a-4e0b-8f7d-aokigahara-net-0002
status: experimental
description: Detects network connections to infrastructure named in the OTX pulse for the AI-train infostealer activity.
author: Security Arsenal Detection Engineering
date: 2026/10/26
references:
  - https://research.checkpoint.com/2026/infostealer-riding-the-ai-train/
logsource:
  category: network_connection
  product: windows
detection:
  selection_domain:
    DestinationHostname|contains:
      - 'neihite.cc'
  selection_ip:
    DestinationIp:
      - '2.26.252.48'
  selection_suspicious_client:
    Image|contains:
      - 'powershell'
      - 'pwsh'
      - 'rundll32'
      - 'regsvr32'
      - 'mshta'
      - 'curl'
      - 'wget'
      - 'node'
      - 'python'
  condition: (selection_domain or selection_ip) and selection_suspicious_client
falsepositives:
  - Threat-intel validation, sandbox detonation, blocked DNS telemetry.
level: critical
tags:
  - attack.command_and_control
  - attack.exfiltration
  - attack.t1071.001
  - attack.t1041
---
title: Infostealer Persistence Near AI Or Credential Staging Artifacts
id: 1f7b6c9e-9a44-4c48-93df-aokigahara-persist-0003
status: experimental
description: Detects autostart modifications referencing AI-tool paths, browser credential paths, archives, or temporary staging names commonly used by infostealers.
author: Security Arsenal Detection Engineering
date: 2026/10/26
references:
  - https://research.checkpoint.com/2026/infostealer-riding-the-ai-train/
logsource:
  category: registry_event
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - 'CurrentVersion\Run'
      - 'CurrentVersion\RunOnce'
  selection_value:
    Details|contains:
      - 'Claude'
      - 'ChatGPT'
      - 'Cursor'
      - 'Windsurf'
      - 'Codex'
      - 'Copilot'
      - 'Gemini'
      - 'Login Data'
      - 'Cookies'
      - 'wallet'
      - '.zip'
      - 'appdata'
      - 'temp'
  condition: selection_key and selection_value
falsepositives:
  - Corporate software updaters and legitimate IDE auto-start entries.
level: medium
tags:
  - attack.persistence
  - attack.t1547.001
  - attack.t1115

let ai_terms = dynamic(['Claude','ChatGPT','Codex','Cursor','Windsurf','Copilot','Gemini','git-credentials','Login Data','Cookies','Web Data','wallet']);
let lol = dynamic(['powershell.exe','pwsh.exe','rundll32.exe','regsvr32.exe','wscript.exe','cscript.exe','mshta.exe','curl.exe','wget.exe','node.exe','python.exe','7z.exe','rar.exe']);
union isfuzzy=true
  (DeviceNetworkEvents
   | where RemoteUrl has_any ('neihite.cc') or RemoteIP == '2.26.252.48'
   | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType),
  (DeviceProcessEvents
   | where FileName in~ (lol) or InitiatingProcessFileName in~ (lol)
   | where ProcessCommandLine has_any (ai_terms) or FileName has_any (ai_terms)
   | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256),
  (DeviceFileEvents
   | where FileName has_any (ai_terms) or FolderPath has_any (ai_terms)
   | where InitiatingProcessFileName in~ (lol)
   | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FileName, FolderPath, ActionType, SHA256)
| sort by TimeGenerated desc

# Read-only hunt for Aokigahara/Kamidere/Stygian style artifacts. Run elevated in a constrained IR context.
$ErrorActionPreference = 'SilentlyContinue'
$iocNet = @('2.26.252.48','neihite.cc')
$aiTerms = @('Claude','ChatGPT','Codex','Cursor','Windsurf','Copilot','Gemini','git-credentials','Login Data','Cookies','Web Data','wallet')
$out = Join-Path $env:TEMP ('ai_infostealer_hunt_' + (Get-Date -Format 'yyyyMMdd_HHmmss') + '.json')
$result = [ordered]@{ Host=$env:COMPUTERNAME; TimeUtc=(Get-Date).ToUniversalTime(); NetworkHits=@(); RunKeyHits=@(); TaskHits=@(); RecentAiArtifacts=@(); HashHits=@() }
Get-NetTCPConnection | Where-Object { $iocNet -contains $_.RemoteAddress } | ForEach-Object {
  $p = Get-Process -Id $_.OwningProcess
  $result.NetworkHits += [pscustomobject]@{ Local=$_.LocalAddress; Remote=$_.RemoteAddress; Port=$_.RemotePort; State=$_.State; Process=$p.ProcessName; Path=$p.Path; PID=$_.OwningProcess }
}
foreach ($dns in $iocNet) {
  Get-DnsClientCache | Where-Object { $_.Entry -like ('*' + $dns + '*') -or $_.Data -like ('*' + $dns + '*') } | ForEach-Object { $result.NetworkHits += [pscustomobject]@{ DnsEntry=$_.Entry; DnsData=$_.Data; Type=$_.Type } }
}
$runKeys = @('HKLM:SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKLM:SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce','HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce')
foreach ($k in $runKeys) {
  Get-ItemProperty $k | ForEach-Object {
    $_.PSObject.Properties | Where-Object { $aiTerms | ForEach-Object { $t=$_; if ($_.Name -like ('*'+$t+'*') -or $_.Value -like ('*'+$t+'*')) { $true } } } | ForEach-Object {
      $result.RunKeyHits += [pscustomobject]@{ Key=$k; Name=$_.Name; Value=$_.Value }
    }
  }
}
Get-ScheduledTask | ForEach-Object {
  $txt = ($_ | Out-String)
  foreach ($t in $aiTerms) { if ($txt -like ('*'+$t+'*')) { $result.TaskHits += [pscustomobject]@{ Task=$_.TaskName; Path=$_.TaskPath; State=$_.State; Matched=$t } } }
}
$roots = @($env:APPDATA,$env:LOCALAPPDATA,$env:USERPROFILE,$env:ProgramData) | Where-Object { $_ -and (Test-Path $_) }
foreach ($r in $roots) {
  Get-ChildItem $r -Recurse -Force -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } | ForEach-Object {
    foreach ($t in $aiTerms) {
      if ($_.FullName -like ('*'+$t+'*')) { $result.RecentAiArtifacts += [pscustomobject]@{ Path=$_.FullName; LastWrite=$_.LastWriteTime; Size=$_.Length } ; break }
    }
  }
}
$hashes = @('987eabfde3ca735273c9e0f5080bdbb0','f0b23f420659babb3a730b122259440091c53c12','04e40fbf5dfff023a657076c4e0d6f257301da049dd351cb3d7aea64a694aa0d','c1bc6228b1f8bd610af0947edcef1ef5','6393c0d3fb76f771a9418c2d152c621929ee002b','bf037920d39b85572ec7e53b51f09c28198c2c0afbc7c7d6cf639b1f047caebf')
$result.RecentAiArtifacts | Where-Object { -not $_.PSIsContainer } | Select-Object -First 200 | ForEach-Object {
  $h = Get-FileHash $_.Path -Algorithm SHA256
  if ($hashes -contains $h.Hash.ToLower()) { $result.HashHits += [pscustomobject]@{ Path=$_.Path; SHA256=$h.Hash } }
}
$result | ConvertTo-Json -Depth 6 | Set-Content -Path $out -Encoding UTF8
Write-Output ('Hunt output: ' + $out)