TonRAT, AsyncRAT & BabaDeda Campaigns: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Potential TonRAT Node.js Implant Execution
id: 1a2b3c4d-5e6f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects the execution of Node.js processes initiated from suspicious locations or by scripts, indicative of TonRAT activity.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/06/25/photo-zip-campaign-targeting-hospitality-industry-delivers-node-js-implant-persistent-access/
author: Security Arsenal
date: 2026/07/26
tags:
    - attack.execution
    - attack.persistence
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\node.exe'
        ParentImage|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
    condition: selection
falsepositives:
    - Legitimate developer activity
level: high
---
title: Steganography Payload Delivery via Office
id: 2b3c4d5e-6f7a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects Office applications spawning PowerShell to download image files, a technique used in AsyncRAT/Remcos campaigns.
references:
    - https://www.levelblue.com/blogs/spiderlabs-blog/asyncrat-and-remcos-delivered-in-multi-stage-phishing-campaign
author: Security Arsenal
date: 2026/07/25
tags:
    - attack.initial_access
    - attack.defense_evasion
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\WINWORD.EXE'
            - '\EXCEL.EXE'
    selection_child:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - '.png'
            - '.jpg'
            - 'Invoke-WebRequest'
            - 'DownloadFile'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate document automation
level: high
---
title: BabaDeda ClickFix Suspicious PowerShell Command
id: 3c4d5e6f-7a8b-8c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects PowerShell commands often associated with ClickFix campaigns and BabuDeda loader, specifically involving copy-paste instructions or base64 encoded payloads.
references:
    - https://www.morphisec.com/blog/what-is-the-babadeda-loader-analysis-of-a-new-clickfix-malware-campaign/
author: Security Arsenal
date: 2026/07/25
tags:
    - attack.execution
    - attack.user_execution
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - 'Set-Clipboard'
            - 'FromBase64String'
    condition: selection
falsepositives:
    - Administrative scripts
level: medium

// Hunt for network connections to known C2 infrastructure from Pulse Data
let IOCs = dynamic(["zloapobikahy23.bond", "prejointl.info", "recallnine.info", "visaphoto-secure.info", "ministrew.info", "heliosup.info", "docshub-secure.com", "visaimage-storage.icu", "cirealci.com", "humansbad2026.com", "192.227.219.79", "107.172.235.213", "91.92.243.161", "89.124.81.216"]);
DeviceNetworkEvents
| where RemoteUrl in (IOCs) or RemoteIP in (IOCs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| extend TimestampUTC = Timestamp


kql
// Hunt for Office spawning PowerShell (AsyncRAT vector)
DeviceProcessEvents
| where InitiatingProcessFileName in (~"WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
| where FileName =~ "powershell.exe"
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, CommandLine, FolderPath
| order by Timestamp desc

# IOC Hunt for TonRAT Persistence and BabaDeda URLs
Write-Host "Starting IOC Hunt..." -ForegroundColor Cyan

# 1. Check Registry for suspicious Run Keys (TonRAT persistence)
$paths = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run", "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run")
$suspiciousProcesses = @("node.exe", "wscript.exe", "mshta.exe")

foreach ($path in $paths) {
    if (Test-Path $path) {
        Get-Item $path | Select-Object -ExpandProperty Property | ForEach-Object {
            $value = (Get-ItemProperty -Path $path -Name $_).$_
            foreach ($proc in $suspiciousProcesses) {
                if ($value -like "*$proc*") {
                    Write-Host "[!] Suspicious Persistence Found in $path" -ForegroundColor Red
                    Write-Host "    Key: $_ | Value: $value"
                }
            }
        }
    }
}

# 2. Scan for Malicious Domains in DNS Cache (Requires Admin)
$maliciousDomains = @("zloapobikahy23.bond", "visaphoto-secure.info", "docshub-secure.com", "cirealci.com", "humansbad2026.com")
try {
    $dnsCache = Get-DnsClientCache -ErrorAction Stop
    foreach ($domain in $maliciousDomains) {
        $hits = $dnsCache | Where-Object { $_.Entry -like "*$domain*" }
        if ($hits) {
            Write-Host "[!] Malicious Domain found in DNS Cache: $domain" -ForegroundColor Red
        }
    }
} catch {
    Write-Host "[!] Could not read DNS Cache (Run as Admin)." -ForegroundColor Yellow
}

Write-Host "Hunt Complete." -ForegroundColor Green