TamperedChef - PDF Editor.exe SentinelOne hunting and hashes

a_rules.md

TamperedChef - PDF Editor.exe - C2 domain

event.dns.request in:anycase("2h4fen.com","2m8ikt.com","2r5kg4.com","2t9nxy.com","3jf4dx.com","5b7crp.com","5dr9jq.com","5dtb9a.com","65rwqc.com","6m4eun.com","7bw3tn.com","8st9kp.com","9mdp5.com","9mdp5f.com","9rw7bc.com","a5cj3m.com","a82kwm.com","abf26u.com","agm62w.com","bw5f1k.com","c6hak4.com","cu5p3k.com","cyj9u7.com","d7sm2w.com","dfm8h5.com","ed6hk4.com","ef84ny.com","f2b9yt.com","gc7pu2.com","gx8en2.com","h4b5dc.com","he5a4f.com","hx3d2a.com","j3a4uw.com","jp1t4y.com","k3rba5.com","k46lej.com","k4d2ab.com","ke9uy4.com","kn7kt2.com","mka3e8.com","n3ij9v.com","nc1p8x.com","p1p9nh.com","p6h5bs.com","pf7g3m.com","pu2mg8.com","r2j8bc.com","r92h4z.com","s4p6tq.com","sc75rj.com","td3y9m.com","v7rh9r.com","w3n7ab.com","x2bvn5.com","xskqr6.com","y2iax5.com","y9pn6a.com")

TamperedChef - PDF Editor.exe - landing pages

event.dns.request in:anycase("9mdp5f.com","advancedtransmitart.net","agipdf.com","allaroundgamers.com","allconvertpdf.com","allgamershere.com","allmanualspdf.com","allpdfconvert.com","allpdflive.com","allpdfplus.com","allpdfpro.com","amazeriencequant.net","apdft.com","apdft.net","apdft.online","apdfty.net","appsuites.ai","ascenti-stage.fiora.agency","astrologyappsuite.com","atozmanual.com","boothgamer.com","businesspdf.com","businesspdf.net","cdasynergy.net","classygamer.com","click4pdf.com","clickconvertio.com","connectnowgamer.com","converteasypdf.com","convertfastpdf.com","convertpdfplus.com","converterbyonestart.com","convertwithonestart.com","cosmicplayerzone.com","digitalgamerzone.com","docpdfzone.com","download02.apdft.online","download04.internetdownloadhub.biz","download04.masterlifemastermind.net","download04.pdfgj.com","download05.masterlifemastermind.net","dropconvert.com","easyconvertpdf.com","easydirectpdf.com","easyformsearch.com","easygetforms.com","easygetpdf.com","easyonestartpdf.com","easyopenpdf.com","easypdfbox.com","easypdfmanuals.com","easypdftool.com","easyquickmanuals.com","easyquickpdf.com","easysearchmanuals.com","easysmartpdf.com","easyviewpdf.com","evergreengamer.com","fastconvertpdf.com","fastonestartpdf.com","fileconverterdownload.com","findallmanuals.com","findthemanual.com","forms-guru.com","foundpdf.com","freegamerzone.com","freegetpdf.com","fullpdf.com","fungamersonline.com","gameongamer.com","gamerproone.com","gamertimespro.com","gamerzonepc.com","getformonline.com","getmanualsfinder.com","getonestart.co","getonestartpdf.com","getpdfonestart.com","getpdflive.com","getpdfpro.com","getpdfquick.com","getsearchmanuals.com","getsmartpdf.com","goeasypdf.com","gogetpdf.com","gopdfhub.com","gopdfmanuals.com","gpt-pdf.com","gridnodeessentials.com","horoscopesbyonestart.com","itpdf.com","itpdf.net","itpdf.org","justconvertpdf.com","justfindmanuals.com","justopenpdf.com","justpdflab.com","justviewpdf.com","launchonestart.co","launchpdfplus.com","levelward.com","lifetimegamer.com","ltdpdf.com","ltdpdf.net","lucentgamers.com","m-appsuite.com","manualbookhub.com","manualfinder.net","manualsappsuite.com","manualsbyappsuite.com","manualsbyonestart.com","manualsfc.com","manualsonestart.com","manualsview.com","manualsviewer.net","masterlifemastermind.net","micromacrotechbase.com","mixgamersworld.com","morethanmanuals.com","myeasypdf.com","mygamergrounds.com","mypdflab.com","mypdfonestart.com","onestartbrowser.com","onestartconverter.com","onestartemplates.com","onestartmanuals.com","onestartpdf.com","onestartpdfdirect.com","onestartpdfplus.com","onestartpdfs.com","onestartprint.com","openpdfnow.com","pdf-central.com","pdf-kiosk.com","pdf-kiosk.net","pdf-kiosks.net","pdf-wizard.net","pdf-working.com","pdfadmin.com","pdfappsuite.com","pdfartisan.com","pdfbyappsuite.com","pdfconvertereasy.com","pdfconvertgroup.com","pdfconvhub.com","pdfdoccentral.com","pdfdocconnect.com","pdfdochub.com","pdfeasyconvertkits.com","pdfeasytool.com","pdfeditorplus.com","pdffacts.com","pdffacts.net","pdffastconvert.com","pdffilehub.com","pdffilehub.net","pdfgj.com","pdfguides.com","pdfguruhub.com","pdfgurupro.com","pdfhubguru.com","pdfhubpro.com","pdfhubspot.com","pdfhubtoday.com","pdfhubweb.com","pdfideas.com","pdflaunch.com","pdfmeta.com","pdfobia.com","pdfonestart.ai","pdfonestart.com","pdfonestarthub.com","pdfonestartlive.com","pdfonestarttoday.com","pdfopia.com","pdforsmartminds.com","pdfpclab.com","pdfplusconvert.com","pdfprosuite.com","pdfprotool.com","pdfquickconverts.com","pdfquickpro.com","pdfreader.live","pdfreplace.com","pdfscraper.com","pdfscraper.site","pdfsmartkit.com","pdfsmartlive.com","pdfsmartonline.com","pdfsmartpro.com","pdfsmartsolution.com","pdf-tool.appsuites.ai","pdftoolapp.com","pdftoolconvert.com","pdftoolplus.com","pdftoolpro.com","pdftoolwin.com","pdftraining.com","pdfts.com","pdfts.site","pdfviewplus.com","pdfworker.com","pdfzonepro.com","platinumgamerz.com","portal.manualfinder.app","print-recipes.com","printappsuite.com","printbyappsuite.com","printeduniverse.com","printwithonestart.com","proeasypdf.com","promanualsfinder.com","proonestarthub.com","proonestartpdf.com","propdfhub.com","proprintperformance.com","publicagipdf.com","publicappsuites.ai","publicclick4pdf.com","publicgpt-pdf.com","publicpdf-central.com","publicpdfadmin.com","publicpdfartisan.com","publicpdfhubspot.com","publicpdfideas.com","publicpdfmeta.com","publicpdforsmartminds.com","publicpdfreplace.com","publicpdfworker.com","publicscholarpdf.com","publictypdf.com","quickconvertpdf.com","quickfastpdf.com","quickgamerpro.com","quickgetforms.com","quickgetmanuals.com","quickgetpdf.com","quickmanualshub.com","quickmanualspro.com","quickpdfeditor.com","quickpdfmanuals.com","quickpdfnow.com","quickpdfonestart.com","quicksmartpdf.com","scholarpdf.com","searchformsfinder.com","searchmanualsnow.com","sharkeagle.com","smartconvertpdf.com","smarteasypdf.com","smartmanualspdf.com","smartonestartpdf.com","smartopenpdf.com","smartpdflab.com","smartpdflive.com","smartpdfpro.com","smartpdftool.com","smartpdfzone.com","smartviewpdf.com","stormcoming.com","supersocialgamers.com","templatesbyonestart.com","theflashgamers.com","thegreygamers.com","themagicgamers.com","thepdfbox.com","thepdfonestart.com","thestargamers.com","thevirtualgamers.com","totalpdfconvert.com","transmitcdnzion.com","typdf.com","videoconverthd.com","viewpdfonestart.com","viewpdfpro.com","viewpdftools.com","webpdfconvert.com","worldbestgamers.com","yoursignwithonestart.com","yourpdfeditor.com","yourpdfhub.com")

TamperedChef - PDF Editor.exe - node .js files

event.type == "Process Creation" AND src.process.name == "node.exe" AND src.process.cmdline matches(".*\\\\AppData\\\\Local\\\\TEMP\\\\[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}.*\\.js")a

TamperedChef - PDF Editor.exe - Scheduled task

task.name='\\PDFEditorScheduledTask'

blocklist.csv