title: Excel Macro Spawning HTA or PowerShell - AsyncRAT/Remcos Campaign
id: 2026-07-05-asyncrat-excel-hta
status: experimental
description: Detects Excel processes spawning mshta.exe or powershell.exe, a common pattern in macro-based malware campaigns delivering RATs.
references:
    - https://www.levelblue.com/blogs/spiderlabs-blog/asyncrat-and-remcos-delivered-in-multi-stage-phishing-campaign
author: Security Arsenal
date: 2026/07/05
tags:
    - attack.initial_access
    - attack.t1566.001
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\EXCEL.EXE'
        NewImage|endswith:
            - '\powershell.exe'
            - '\mshta.exe'
    condition: selection
falsepositives:
    - Legitimate administrative scripts
level: high
---
title: PowerShell Steganography Pattern - Image Download
id: 2026-07-05-powershell-stego-image
description: Detects PowerShell scripts attempting to download image files (PNG/JPG) which may contain steganographic payloads used by AsyncRAT/Remcos campaigns.
references:
    - Internal Research
author: Security Arsenal
date: 2026/07/05
tags:
    - attack.defense_evasion
    - attack.t1027
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - '.png'
            - '.jpg'
            - 'Invoke-WebRequest'
            - 'DownloadFile'
    selection_obfu:
        CommandLine|contains:
            - 'FromBase64String'
            - 'IEX'
    condition: all of selection_*
falsepositives:
    - Legitimate image manipulation scripts
level: medium
---
title: Suspicious Outbound Connection to AsyncRAT C2 Infrastructure
id: 2026-07-05-asyncrat-c2-connection
status: experimental
description: Detects outbound network connections to known AsyncRAT/Remcos C2 IP addresses associated with the Colocrossing ASN.
references:
    - https://otx.alienvault.com/pulse/614115669d093c58539e8183617a62a59aefd1a9a1fddcc7a67508f2fb9e36ab
author: Security Arsenal
date: 2026/07/05
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationIp:
            - '107.172.235.213'
            - '198.12.83.75'
            - '192.227.219.79'
            - '173.231.188.244'
        DestinationPort|endswith:
            - '4550'
            - '80'
            - '443'
    condition: selection
falsepositives:
    - Unknown
level: critical

// Hunt for connections to known malicious IPs from the pulse
DeviceNetworkEvents
| where RemoteIP in ("107.172.235.213", "198.12.83.75", "192.227.219.79", "173.231.188.244")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemotePort, InitiatingProcessFileName

// Hunt for process chain: Excel spawning PowerShell
DeviceProcessEvents
| where InitiatingProcessFileName =~ "excel.exe" and (FileName =~ "powershell.exe" or FileName =~ "mshta.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine

# IOC Hunt Script for AsyncRAT/Remcos Campaign
# Checks for specific file hashes and suspicious persistence mechanisms

$MaliciousHashes = @(
    "614115669d093c58539e8183617a62a59aefd1a9a1fddcc7a67508f2fb9e36ab",
    "0b47f8d79e37ebec7edd2333ab70caa1e3e710b310b8201c5447820886ce8d49",
    "248da1553ce35bb6c499a660fcd92bde6e3545b56b65b63308e7b7630f376bfc"
)

Write-Host "[+] Scanning for malicious file hashes..." -ForegroundColor Cyan

# Scan C:\ Drive for specific hashes (Note: This can be resource intensive)
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
    ForEach-Object {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($hash -in $MaliciousHashes) {
            Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
        }
    }

# Check Registry for common RAT persistence paths
Write-Host "[+] Scanning Registry for persistence keys..." -ForegroundColor Cyan
$RunPaths = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
)

foreach ($path in $RunPaths) {
    if (Test-Path $path) {
        Get-Item -Path $path | Select-Object -ExpandProperty Property | ForEach-Object {
            $value = (Get-ItemProperty -Path $path -ErrorAction SilentlyContinue).$_
            if ($value -match "powershell" -or $value -match "mshta" -or $value -match ".exe") {
                Write-Host "[+] Suspicious Value in $path : $_ = $value" -ForegroundColor Yellow
            }
        }
    }
}

Write-Host "[+] Hunt complete." -ForegroundColor Green


# Response Priorities

1.  **Immediate**:
    *   **Block IOCs**: Immediately block the listed IPv4 addresses and the URL at the network perimeter and proxy servers.
    *   **Quarantine**: Scan email gateways for Excel attachments matching the provided file hashes and quarantine them.

2.  **24 Hours**:
    *   **Hunt Artifacts**: Execute the provided PowerShell script across the enterprise to identify any dropped files or persistence keys.
    *   **Network Forensics**: Review firewall/proxy logs for any successful connections to the C2 IPs to identify potentially compromised hosts.

3.  **1 Week**:
    *   **Hardening**: Disable macros for users who do not have a specific business requirement. Implement Attack Surface Reduction (ASR) rules to block Office applications from creating child processes.
    *   **Training**: Conduct security awareness training focused on identifying phishing emails with unexpected attachments.