---
title: Suspicious AI Platform Impersonation Domain Resolution
id: 7f3a2c1e-9d44-4b2a-a1c8-otxai00001
status: experimental
description: Detects DNS resolution of known malicious AI-platform impersonation domains identified in OTX pulse (claude.ai.download-app.us campaign). No legitimate traffic should resolve these hosts.
author: Security Arsenal Threat Intelligence
 date: 2026/09/22
references:
    - https://nsfocusglobal.com/ai-security-incident-case-trusted-ai-platforms-become-a-new-channel-for-malware-distribution/
logsource:
    category: dns
detection:
    selection:
        query|contains:
            - 'download-app.us'
            - 'polse.us'
            - 'claude.ai.download-app.us'
    condition: selection
falsepositives:
    - Threat intelligence sandbox detonation
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
---
title: Browser Credential Store Access by Non-Browser Process
id: 7f3a2c1e-9d44-4b2a-a1c8-otxai00002
status: experimental
description: Detects infostealer behavior — a non-browser process reading Chrome/Edge/Firefox credential databases. Core behavior of credential-harvesting payloads distributed via fake AI platform installers.
author: Security Arsenal Threat Intelligence
date: 2026/09/22
logsource:
    category: file_event
    product: windows
detection:
    selection_paths:
        TargetFilename|contains:
            - '\Google\Chrome\User Data\'
            - '\Microsoft\Edge\User Data\'
            - '\BraveSoftware\Brave-Browser\User Data\'
        TargetFilename|endswith:
            - '\Login Data'
            - '\Cookies'
            - '\Web Data'
            - '\Local State'
    filter_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\brave.exe'
            - '\firefox.exe'
    condition: selection_paths and not filter_browsers
falsepositives:
    - Legitimate backup or EDR software accessing browser profiles
    - Enterprise password management tools
level: high
tags:
    - attack.credential_access
    - attack.t1555.003
    - attack.t1539
---
title: Fake AI Assistant Installer Persistence via Registry Run Key
id: 7f3a2c1e-9d44-4b2a-a1c8-otxai00003
status: experimental
description: Detects persistence establishment via Run keys using AI-assistant-themed value names, consistent with trojanized AI platform installer behavior described in OTX reporting.
author: Security Arsenal Threat Intelligence
date: 2026/09/22
logsource:
    category: registry_set
    product: windows
detection:
    selection_key:
        TargetObject|contains:
            - '\CurrentVersion\Run'
            - '\CurrentVersion\RunOnce'
    selection_names:
        Details|contains:
            - 'AIAssistant'
            - 'ClaudeApp'
            - 'Claude Desktop'
            - 'AIUpdater'
            - 'AssistantUpdater'
    condition: selection_key and selection_names
falsepositives:
    - Legitimate AI desktop applications installed from verified vendor sources — validate signer and install path
level: high
tags:
    - attack.persistence
    - attack.t1060
    - attack.t1547.001

// Hunt: AI-platform impersonation infrastructure + credential store access
// OTX pulse: claude.ai.download-app.us campaign (2026-09-22)
let maliciousDomains = dynamic(["download-app.us", "polse.us", "claude.ai.download-app.us"]);
let lookalikePattern = @"(openai|claude|anthropic|chatgpt|gemini|copilot)[.-]?(ai|app|desktop)?\.[a-z0-9-]+\.(us|top|xyz|shop|online|click|app)$";
let DnsHits = DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteUrl has_any (maliciousDomains)
       or (RemoteUrl matches regex lookalikePattern and RemoteUrl !has "anthropic.com" and RemoteUrl !has "openai.com" and RemoteUrl !has "microsoft.com" and RemoteUrl !has "google.com")
    | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count(), RemoteIPs=make_set(RemoteIP), InitiatingProcesses=make_set(InitiatingProcessFileName)
        by DeviceName, RemoteUrl, InitiatingProcessAccountName
    | project DeviceName, RemoteUrl, FirstSeen, LastSeen, Connections, RemoteIPs, InitiatingProcesses, InitiatingProcessAccountName;
let CredStoreAccess = DeviceFileEvents
    | where TimeGenerated > ago(30d)
    | where FolderPath has_any (@"\Login Data", @"\Web Data") or FileName in~ ("logins.json", "key4.db")
    | where FolderPath has_any (@"\Chrome\User Data\", @"\Edge\User Data\", @"\Brave-Browser\", @"\Mozilla\Firefox\")
    | where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "MsMpEng.exe")
    | summarize FirstSeen=min(TimeGenerated), FilesAccessed=make_set(FileName) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine;
DnsHits
| union (CredStoreAccess | extend RemoteUrl="", FirstSeen=FirstSeen, LastSeen=FirstSeen, Connections=0, RemoteIPs=dynamic([]), InitiatingProcesses=InitiatingProcessFileName, InitiatingProcessAccountName="", InitiatingProcessCommandLine=strcat(InitiatingProcessFileName, " ", InitiatingProcessCommandLine))
| sort by FirstSeen asc

# Security Arsenal - AI Impersonation Campaign IOC Hunt
# OTX Pulse: claude.ai.download-app.us (2026-09-22)
# Run as admin across fleet via RMM/Intune/SCCM or locally for triage

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

Write-Host "[*] 1/4 Checking DNS cache for malicious AI-impersonation domains..." -ForegroundColor Cyan
$badDomains = @('download-app.us','polse.us','claude.ai.download-app.us')
$dnsCache = Get-DnsClientCache | Where-Object {
    $entry = $_.Entry
    $badDomains | Where-Object { $entry -like "*$_*" }
}
foreach ($hit in $dnsCache) {
    $report += [PSCustomObject]@{Check='DNSCache'; Finding=$hit.Entry; Detail="Data: $($hit.Data)"; Severity='CRITICAL'}
}

Write-Host "[*] 2/4 Sweeping Run keys for AI-assistant persistence..." -ForegroundColor Cyan
$runPaths = @(
    'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce',
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce'
)
foreach ($path in $runPaths) {
    $props = Get-ItemProperty -Path $path
    if ($props) {
        $props.PSObject.Properties | Where-Object {
            $_.Name -match 'AI|Claude|Assistant|Updater' -and $_.Name -notmatch '^PS'
        } | ForEach-Object {
            # Flag if binary is unsigned or in a user-writable path
            $bin = ($_.Value -split ' ')[0] -replace '"',''
            $suspicious = ($_.Value -match 'AppData|Temp|Public') -or
                          ((Test-Path $bin) -and -not (Get-AuthenticodeSignature $bin).SignerCertificate)
            if ($suspicious) {
                $report += [PSCustomObject]@{Check='RunKey'; Finding="$path\$($_.Name)"; Detail=$_.Value; Severity='HIGH'}
            }
        }
    }
}

Write-Host "[*] 3/4 Checking scheduled tasks for masquerading updater jobs..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {
    $_.TaskName -match 'AI|Claude|Assistant' -and
    ($_.Actions.Execute -match 'AppData|Temp|Public')
} | ForEach-Object {
    $report += [PSCustomObject]@{Check='ScheduledTask'; Finding=$_.TaskName; Detail=$_.Actions.Execute; Severity='HIGH'}
}

Write-Host "[*] 4/4 Auditing active connections to known C2 infrastructure..." -ForegroundColor Cyan
$connections = Get-NetTCPConnection -State Established |
    Where-Object { $_.RemotePort -in 443,8443,80 } |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess
        [PSCustomObject]@{
            Check='NetConn'
            Finding="$($proc.ProcessName) (PID $($_.OwningProcess)) -> $($_.RemoteAddress):$($_.RemotePort)"
            Detail=$proc.Path
            Severity= if ($proc.Path -match 'AppData|Temp|Public') {'HIGH'} else {'INFO'}
        }
    }
$report += $connections | Where-Object { $_.Severity -eq 'HIGH' }

Write-Host "`n===== HUNT RESULTS =====" -ForegroundColor Yellow
if ($report.Count -eq 0) {
    Write-Host "[+] No indicators of the AI-impersonation campaign found on this host." -ForegroundColor Green
} else {
    $report | Sort-Object Severity | Format-Table -AutoSize
    $report | Export-Csv -Path "$env:TEMP\ai_impersonation_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
    Write-Host "[!] $($report.Count) findings exported to $env:TEMP" -ForegroundColor Red
}