AsyncAPI npm Supply Chain RAT, VShell/SNOWLIGHT Go Loader & AnonyMousKIT AI PhaaS: OTX Pulse Analysis — Enterprise Detection Pack

---
title: NPM Lifecycle Hook Script Execution from node_modules
id: 8f3a1c2e-async-0001-supplychain-hook
status: experimental
description: Detects node/npm spawning script interpreters or shells from node_modules paths, consistent with AsyncAPI supply chain lifecycle-hook RAT staging
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.cmd'
      - '\npm.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\curl.exe'
      - '\certutil.exe'
  selection_path:
    CommandLine|contains:
      - 'node_modules'
  condition: selection_parent and selection_child and selection_path
falsepositives:
  - Legitimate build tooling with native compilation (node-gyp)
level: high
tags:
  - attack.initial_access
  - attack.t1195.001
  - attack.execution
  - attack.t1059
date: 2026/08/28
---
title: Suspicious IPFS Gateway Payload Retrieval
id: 8f3a1c2e-async-0002-ipfs-retrieval
status: experimental
description: Detects HTTP/HTTPS retrieval from public IPFS gateways by non-browser processes, matching the AsyncAPI RAT IPFS payload delivery mechanism
author: Security Arsenal Threat Intel
logsource:
  category: network_connection
  product: windows
  service: sysmon
detection:
  selection_domain:
    DestinationHostname|contains:
      - 'ipfs.io'
      - 'gateway.pinata.cloud'
      - 'cloudflare-ipfs.com'
      - 'dweb.link'
      - 'ipfs.infura.io'
  selection_ip:
    DestinationIp:
      - '85.137.53.71'
      - '38.207.178.192'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\brave.exe'
  condition: (selection_domain or selection_ip) and not filter_browsers
falsepositives:
  - Developers legitimately using IPFS tooling (rare in enterprise)
level: high
tags:
  - attack.command_and_control
  - attack.t1102
  - attack.t1071.001
date: 2026/08/28
---
title: Go Loader Sleep Evasion and Sandbox Check Behavior
id: 8f3a1c2e-vshl-0003-snowlight-loader
status: experimental
description: Detects unsigned executables launched from user-writable paths that perform CPU count queries followed by delayed child process execution, consistent with SNOWLIGHT Go loader sandbox evasion
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\Downloads\'
  selection_evasion:
    CommandLine|contains:
      - 'NumberOfProcessors'
      - 'GetSystemInfo'
      - 'Win32_Processor'
      - '/dev/null'
      - 'sleep'
      - 'timeout'
  selection_doc:
    CommandLine|contains:
      - '.docx'
      - 'resume'
      - 'cv'
      - '\u7b80\u5386'
  condition: selection_path and (selection_evasion or selection_doc)
falsepositives:
  - Legitimate document handlers in Downloads folders
level: medium
tags:
  - attack.defense_evasion
  - attack.t1497
  - attack.t1497.001
  - attack.t1036
date: 2026/08/28

// Security Arsenal Hunt: AsyncAPI RAT + SNOWLIGHT/VShell + AnonyMousKIT IOC sweep
// Run across 30 days in Microsoft Sentinel
let BadIPs = dynamic(["85.137.53.71", "38.207.178.192"]);
let BadHashes = dynamic([
  "bfaeb987faa6de2b5a5eb63b1233d055215b09b0349a9394f2175fd7cdf385e4",
  "b9993a8ad0518849416798cf29668256ccb96598fc4423501ccab5312812653a",
  "24b9ee242f21a73b55f7bb3297eafb33c60840907386b542ed79fc6b72365168",
  "c25d4412f7f93e7de5b2aaf41747175d94cffd983ca20efbd0efcdd718b58c4d",
  "81c51138d5527ca7dcc258171eb36659c479f66c86a8947b6340d040b3860a30",
  "f6d4da5afc89bf9e536a9002c4d256c696df2389d77279f4c5daf6979557e74e",
  "0524619d2471d77aba4b7993f5ffbaa4b8be6d2c0d91e63a02943851dc4b6404",
  "ed2eaa6ef3eda95383b6efc35b88acbca742ad7bd118931f74727a3139ff7e97",
  "c666ac4f1a1b8df7ccfe8b19705279acd8b7eb7a4d0b3802bb3465064883ab25"]);
let PhaaSDomains = dynamic([
  "apple-unlock.com", "buscar-lphone.com", "suporte-lcloud.com",
  "com-maps.info", "findmy-dispositivos.com", "id-ubicacion.com",
  "findsupport.live", "zu7pl.pro"]);
union isfuzzy=true
  (DeviceNetworkEvents
   | where RemoteIP in (BadIPs) or RemoteUrl in~ (PhaaSDomains)
   | project Hit="NetworkIOC", TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort),
  (DeviceProcessEvents
   | where SHA256 in (BadHashes) or MD5 in~ (dynamic(["d602f4eeb914cf32782799376a8c5953","a7cc7e3cdd2f0f9210044911a483fa5d"]))
   | project Hit="HashIOC", TimeGenerated, DeviceName, FileName, ProcessCommandLine, SHA256),
  (DeviceProcessEvents
   | where InitiatingProcessFileName in~ ("node.exe","npm.cmd","npm.exe")
   | where ProcessCommandLine has_any ("node_modules","ipfs","gateway.pinata","dweb.link")
   | project Hit="LifecycleHookBehavior", TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName),
  (DeviceNetworkEvents
   | where RemoteUrl has_any ("ipfs.io","gateway.pinata.cloud","cloudflare-ipfs.com","dweb.link")
   | where InitiatingProcessFileName !in~ ("chrome.exe","firefox.exe","msedge.exe","brave.exe")
   | project Hit="IPFSRetrieval", TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP)
| sort by TimeGenerated desc

# Security Arsenal IOC Hunt Script
# Targets: AsyncAPI RAT artifacts, SNOWLIGHT/VShell persistence, PhaaS DNS exposure
# Run elevated on endpoints; output to CSV for fleet-wide collection

$report = @()

# --- 1. Network connections to known C2 ---
$badIPs = @("85.137.53.71", "38.207.178.192")
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $badIPs -contains $_.RemoteAddress }
foreach ($c in $conns) {
    $proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
    $report += [PSCustomObject]@{Check="C2_Connection"; Detail="$($proc.ProcessName) -> $($c.RemoteAddress):$($c.RemotePort)"; Host=$env:COMPUTERNAME}
}

# --- 2. DNS cache check for AnonyMousKIT phishing domains ---
$phaaS = @("apple-unlock.com","buscar-lphone.com","suporte-lcloud.com","com-maps.info","findmy-dispositivos.com","id-ubicacion.com","findsupport.live","zu7pl.pro")
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $n = $_.Name; $phaaS | Where-Object { $n -like "*$_*" } }
foreach ($d in $dns) {
    $report += [PSCustomObject]@{Check="PhaaS_DNS"; Detail="$($d.Name) -> $($d.Data)"; Host=$env:COMPUTERNAME}
}

# --- 3. VShell persistence artifacts: Run keys with suspicious paths ---
$runKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
             "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
foreach ($key in $runKeys) {
    Get-ItemProperty -Path $key -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Value -match "AppData|Temp|Public" -and $_.Name -notmatch "^PS" } | ForEach-Object {
            $report += [PSCustomObject]@{Check="RunKey_Persistence"; Detail="$($_.Name)=$($_.Value)"; Host=$env:COMPUTERNAME}
        }
    }
}

# --- 4. Scheduled tasks executing from user-writable paths ---
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
    $actions = $_.Actions | Where-Object { $_.Execute -match "AppData|Temp|Users\\Public" }
    foreach ($a in $actions) {
        $report += [PSCustomObject]@{Check="ScheduledTask_Persistence"; Detail="$($_.TaskName): $($a.Execute)"; Host=$env:COMPUTERNAME}
    }
}

# --- 5. Malicious file hash sweep in common staging dirs ---
$badHashes = @("bfaeb987faa6de2b5a5eb63b1233d055215b09b0349a9394f2175fd7cdf385e4",
               "c25d4412f7f93e7de5b2aaf41747175d94cffd983ca20efbd0efcdd718b58c4d",
               "81c51138d5527ca7dcc258171eb36659c479f66c86a8947b6340d040b3860a30")
$dirs = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA", "C:\Users\Public", "$env:USERPROFILE\Downloads")
foreach ($dir in $dirs) {
    Get-ChildItem -Path $dir -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($badHashes -contains $h.ToLower()) {
            $report += [PSCustomObject]@{Check="Hash_Match"; Detail="$($_.FullName) [$h]"; Host=$env:COMPUTERNAME}
        }
    }
}

# --- 6. Compromised AsyncAPI packages in node_modules ---
Get-ChildItem -Path "$env:USERPROFILE","C:\Projects","C:\src" -Recurse -Directory -Filter "node_modules" -Depth 4 -ErrorAction SilentlyContinue | ForEach-Object {
    Get-ChildItem -Path $_.FullName -Filter "sync.js" -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
        $report += [PSCustomObject]@{Check="Suspicious_SyncJS"; Detail=$_.FullName; Host=$env:COMPUTERNAME}
    }
}

if ($report.Count -gt 0) { $report | Format-Table -AutoSize; $report | Export-Csv -Path ".\ioc_hunt_$env:COMPUTERNAME.csv" -NoTypeInformation }
else { Write-Output "[+] No IOC hits on $env:COMPUTERNAME" }