ShinyHunters, Potemkin & AsyncRAT Campaigns: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Potential Potemkin Loader Activity via HTA
description: Detects HTA applications spawning MSI installers, a behavior associated with the Potemkin Loader and ClickFix campaigns.
status: experimental
author: Security Arsenal
date: 2026/06/17
tags:
  - attack.initial_access
  - attack.execution
  - clickfix
  - potemkin
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\\mshta.exe'
    Image|endswith:
      - '\\msiexec.exe'
  condition: selection
falsepositives:
  - Legitimate software installers launched via web
level: high
---
title: AsyncRAT AI-Themed LNK Execution
description: Detects PowerShell execution spawned by Windows Explorer via LNK files, often indicative of malicious shortcuts used in AI-themed campaigns.
status: experimental
author: Security Arsenal
date: 2026/06/17
tags:
  - attack.initial_access
  - attack.user_execution
  - asyncrat
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\\explorer.exe'
  selection_child:
    Image|endswith:
      - '\\powershell.exe'
    CommandLine|contains:
      - 'downloadstring'
      - 'iex'
  selection_keywords:
    CommandLine|contains:
      - 'AI'
      - 'GPT'
      - 'chat'
  condition: all of selection_*
falsepositives:
  - Legitimate administrative scripts
level: medium
---
title: MeshCentral Agent Network Connection
description: Detects network connections to MeshCentral agent paths (agent.ashx) often used by UNC6240 for C2.
status: experimental
author: Security Arsenal
date: 2026/06/17
tags:
  - attack.command_and_control
  - attack.t1071
  - unc6240
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort|endswith:
      - '443'
    DestinationUrl|contains:
      - '/agent.ashx'
  condition: selection
falsepositives:
  - Legitimate MeshCentral usage (verify against asset inventory)
level: critical

// Hunt for Potemkin Loader and AsyncRAT Execution Chains
let SuspiciousDomains = dynamic([\"azurenetfiles.net\", \"resumeacceptable.com\", \"shampobiskworld.nl\", \"cl.distritovagas.com\"]);
let SuspiciousHashes = dynamic([\"c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f\", \"79f7b67ce8b39070f3e1c2b90fce0ce84134782a7dedcccc1edac197ee9e089b\"]);
// Process Creation Events
DeviceProcessEvents
| where (ProcessCommandLine contains \"Invoke-Expression\" or ProcessCommandLine contains \"IEX\") 
   or (InitiatingProcessFileName == \"mshta.exe\" and FileName == \"msiexec.exe\")
   or (InitiatingProcessFileName == \"explorer.exe\" and FileName == \"powershell.exe\" and ProcessCommandLine matches regex @\"(?i)(AI|GPT)\")
| extend ThreatType = iff(InitiatingProcessFileName == \"mshta.exe\", \"Potemkin-ClickFix\", \"AsyncRAT-Lure\")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, ThreatType, AccountName, SHA256
| union (
    DeviceNetworkEvents
    | where RemoteUrl in (SuspiciousDomains) or RemoteIP in (\"176.120.22.24\", \"77.110.122.58\")
    | project Timestamp, DeviceName, RemoteUrl, RemoteIP, ThreatType=\"C2-Communication\"
)
| order by Timestamp desc

<#
.SYNOPSIS
    IOC Hunt Script for ShinyHunters, Potemkin, and AsyncRAT
.DESCRIPTION
    Checks for Scheduled Tasks, Registry Run Keys, and Network Connections associated with the provided OTX Pulses.
#>

$IOC_Domains = @(
    \"azurenetfiles.net\",
    \"resumeacceptable.com\",
    \"shampobiskworld.nl\",
    \"shampoolagtto.com\",
    \"sonra.eutialyson.com\"
)

$IOC_Hashes = @(
    \"c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f\", # MeshCentral Agent
    \"79f7b67ce8b39070f3e1c2b90fce0ce84134782a7dedcccc1edac197ee9e089b\"  # Potemkin MSI
)

Write-Host \"[+] Checking Scheduled Tasks for Suspicious Actions (AsyncRAT/Potemkin)...\" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { 
    $_.Actions.Execute -like \"*powershell*\" -or 
    $_.Actions.Execute -like \"*cmd*\" -or 
    $_.Actions.Execute -like \"*mshta*\" 
} | Select-Object TaskName, State, Actions

Write-Host \"[+] Checking Registry Run Keys for Persistence...\" -ForegroundColor Cyan
$RunPaths = @(\"HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\", \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\")
foreach ($Path in $RunPaths) {
    if (Test-Path $Path) {
        Get-Item $Path | Select-Object -ExpandProperty Property | ForEach-Object {
            $Value = (Get-ItemProperty -Path $Path -Name $_).$_
            if ($Value -match \".*\.exe.*\" -or $Value -match \"powershell\") {
                Write-Host \"Found: $_ = $Value\" -ForegroundColor Yellow
            }
        }
    }
}

Write-Host \"[+] Checking Hosts File for IOC Domains...\" -ForegroundColor Cyan
$HostsPath = \"$env:SystemRoot\\System32\\drivers\\etc\\hosts\"
if (Test-Path $HostsPath) {
    $Content = Get-Content $HostsPath
    foreach ($Domain in $IOC_Domains) {
        if ($Content -match $Domain) {
            Write-Host \"[!] SUSPICIOUS: $Domain found in hosts file!\" -ForegroundColor Red
        }
    }
}

Write-Host \"[+] Checking Recent Processes for Hash Matches...\" -ForegroundColor Cyan
# Note: This requires admin privileges and might be noisy. Simulating check logic.
Write-Host \"Manual verification required for file hashes in C:\\Windows\\Temp and User Downloads.\"