UAC-0099 ASHVEIN RAT: Detecting HTML-Weaponized C2 and .NET Infostealer Activity Against Government Targets

---
title: HTML or HTA File Spawning Script Interpreter or Shell
description: Detects HTML/HTA content (consistent with UAC-0099 lure and HTML-smuggling tradecraft delivering ASHVEIN) executing script interpreters or command shells. Legitimate browsers render HTML; HTML files do not legitimately spawn cmd, PowerShell, wscript, or mshta in typical user workflows.
references:
  - https://thehackernews.com/2026/10/uac-0099-targets-ukrainian-government.html
  - https://attack.mitre.org/techniques/T1204/002/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/21
status: experimental
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parents:
    ParentImage|endswith:
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\hh.exe'
  selection_children:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\msbuild.exe'
      - '\regasm.exe'
      - '\regsvcs.exe'
  condition: all of selection_*
falsepositives:
  - Rare legacy enterprise help-file or HTA administrative tools
level: high
---
title: Suspicious .NET Payload Execution From User-Writable Directories
description: Detects execution of unsigned-style .NET tooling and executables from user profile paths (AppData, Temp, Downloads, Public), consistent with ASHVEIN's .NET implant staging. Also covers inline .NET compilation hosts abused for fileless execution.
references:
  - https://thehackernews.com/2026/10/uac-0099-targets-ukrainian-government.html
  - https://attack.mitre.org/techniques/T1218/
  - https://attack.mitre.org/techniques/T1140/
author: Security Arsenal
date: 2026/10/21
status: experimental
tags:
  - attack.defense_evasion
  - attack.t1218
  - attack.t1140
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Downloads\'
      - '\Users\Public\'
  selection_dotnet_hosts:
    Image|endswith:
      - '\regasm.exe'
      - '\regsvcs.exe'
      - '\msbuild.exe'
      - '\csc.exe'
      - '\vbc.exe'
      - '\installutil.exe'
  selection_encoded_cli:
    CommandLine|contains:
      - '-enc'
      - '-EncodedCommand'
      - 'FromBase64String'
      - 'Reflection.Assembly'
      - 'Assembly.Load'
  condition: selection_path or (selection_dotnet_hosts and selection_encoded_cli)
falsepositives:
  - Developer workstations compiling .NET code; exclude known dev paths
level: high
---
title: Non-Browser Process Making Repeated HTTP Requests to Web Content
description: Detects non-browser processes establishing outbound HTTP/HTTPS connections on standard web ports, consistent with ASHVEIN polling HTML-hosted C2 tasking. Baseline known update services and EDR telemetry before enabling at high sensitivity.
references:
  - https://thehackernews.com/2026/10/uac-0099-targets-ukrainian-government.html
  - https://attack.mitre.org/techniques/T1071/001/
  - https://attack.mitre.org/techniques/T1102/
author: Security Arsenal
date: 2026/10/21
status: experimental
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1102
logsource:
  category: network_connection
  product: windows
detection:
  selection_ports:
    DestinationPort:
      - 80
      - 443
  selection_process:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\regasm.exe'
      - '\regsvcs.exe'
      - '\msbuild.exe'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\iexplore.exe'
  condition: selection_ports and selection_process and not filter_browsers
falsepositives:
  - PowerShell update/bootstrap scripts in managed environments
  - Software deployment tooling
level: medium

// ASHVEIN / UAC-0099 hunt: HTML lure execution + non-browser HTTP(S) C2 polling
let Lookback = 14d;
let HtmlArtifacts = DeviceFileEvents
| where TimeGenerated > ago(Lookback)
| where FileName endswith ".html" or FileName endswith ".hta"
| where FolderPath has_any ("\\Temp\\", "\\Downloads\\", "\\AppData\\", "\\Public\\")
| project DeviceName, FileCreated=TimeGenerated, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine;
let ScriptExec = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe", "msbuild.exe", "regasm.exe", "regsvcs.exe")
| where InitiatingProcessFileName in~ ("mshta.exe", "wscript.exe", "cscript.exe", "hh.exe", "chrome.exe", "msedge.exe", "outlook.exe")
   or ProcessCommandLine has_any ("FromBase64String", "Assembly.Load", "-enc", "WebClient", "DownloadString")
| project DeviceName, ExecTime=TimeGenerated, FileName, ProcessCommandLine, InitiatingProcessFileName;
let C2Traffic = DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemotePort in (80, 443)
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe", "svchost.exe", "msmpeng.exe")
| where InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe", "rundll32.exe", "regsvr32.exe", "mshta.exe", "wscript.exe", "msbuild.exe", "regasm.exe", "regsvcs.exe")
| summarize Connections=count(), Destinations=dcount(RemoteIP), RemoteIPs=make_set(RemoteIP, 10), RemoteUrls=make_set(RemoteUrl, 10) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| where Destinations >= 1;
HtmlArtifacts
| join kind=inner ScriptExec on DeviceName
| join kind=leftouter C2Traffic on DeviceName
| project DeviceName, FileCreated, FolderPath, FileName, ExecTime, FileName1, ProcessCommandLine, Destinations, RemoteIPs, RemoteUrls
| order by DeviceName asc, FileCreated asc

-- ASHVEIN / UAC-0099 endpoint sweep: HTML lures, user-dir execution, Run-key persistence
-- Artifact: Custom.Hunt.ASHVEIN.EndpointSweep

LET html_lures = SELECT FullPath AS LurePath, Size, Mtime, Btime
FROM glob(globs=['C:/Users/*/Downloads/*.html', 'C:/Users/*/Downloads/*.hta',
                 'C:/Users/*/AppData/Local/Temp/*.html', 'C:/Users/*/AppData/Local/Temp/*.hta',
                 'C:/Users/Public/*.html', 'C:/Users/Public/*.hta'])
WHERE Btime > now() - 1209600

LET suspicious_procs = SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)\\(AppData|Temp|Downloads|Public)\\'
   OR CommandLine =~ '(?i)(FromBase64String|Assembly\.Load|DownloadString|WebClient)'

LET run_keys = SELECT FullPath AS RegPath, Name, value.description AS ValueData
FROM glob(globs=['HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Run/*'],
          accessor='registry')
WHERE to_dict(item={
  'Path': RegPath,
  'Name': Name
}) AND ValueData =~ '(?i)(\\AppData\\|\\Temp\\|\\Public\\|\.hta|mshta|powershell)'

SELECT * FROM html_lures
UNION ALL
SELECT * FROM suspicious_procs

# ASHVEIN / UAC-0099 — Audit and Harden (run as Administrator)
# 1. AUDIT: Recent HTML/HTA files in user-writable paths
Write-Host "[AUDIT] Recent HTML/HTA files in user-writable locations:" -ForegroundColor Cyan
$cutoff = (Get-Date).AddDays(-14)
Get-ChildItem -Path "$env:SystemDrive\Users" -Include *.html,*.hta -Recurse -ErrorAction SilentlyContinue |
  Where-Object { $_.CreationTime -gt $cutoff -and $_.FullName -match 'Temp|Downloads|Public' } |
  Select-Object FullName, CreationTime, Length | Format-Table -AutoSize

# 2. AUDIT: Run-key persistence pointing at user profile paths
Write-Host "[AUDIT] Suspicious Run-key persistence entries:" -ForegroundColor Cyan
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($key in $runKeys) {
  if (Test-Path $key) {
    (Get-ItemProperty $key).PSObject.Properties |
      Where-Object { $_.Value -match 'AppData|Temp|Public|\.hta|mshta|powershell' } |
      Select-Object Name, Value
  }
}

# 3. AUDIT: Non-browser processes with recent outbound web connections
Write-Host "[AUDIT] Non-browser processes with established 80/443 connections:" -ForegroundColor Cyan
Get-NetTCPConnection -State Established -RemotePort 80,443 -ErrorAction SilentlyContinue |
  ForEach-Object {
    $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($p -and $p.ProcessName -notmatch '^(chrome|msedge|firefox|iexplore|svchost|msedge)$') {
      [PSCustomObject]@{ Process=$p.ProcessName; PID=$_.OwningProcess; RemoteIP=$_.RemoteAddress; RemotePort=$_.RemotePort }
    }
  } | Format-Table -AutoSize

# 4. HARDEN: Enable Attack Surface Reduction rules (AUDIT mode first — validate, then set to 1/Block)
# Blocks Office child processes and executable content from email clients/webmail
$asrRules = @{
  'D4F940AB-401B-4EFC-AADC-AD5F3C50688A' = 1  # Block Office apps from creating child processes
  'BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550' = 1  # Block executable content from email client and webmail
  '92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B' = 1  # Block Win32 API calls from Office macros
  '7674BA52-37EB-4A4F-A9A1-F0F9A1619A2C' = 1  # Block abuse of exploited vulnerable signed drivers (optional)
}
foreach ($rule in $asrRules.GetEnumerator()) {
  Add-MpPreference -AttackSurfaceReductionRules_Ids $rule.Key -AttackSurfaceReductionRules_Actions $rule.Value
  Write-Host "[HARDEN] ASR rule $($rule.Key) set to action $($rule.Value)" -ForegroundColor Green
}

# 5. HARDEN: Disable mshta.exe handling of .hta via file association warning (defense-in-depth)
# Consider an AppLocker/WDAC policy to block mshta.exe for standard users instead where feasible
Write-Host "[HARDEN] Recommend: Deploy AppLocker/WDAC rule blocking mshta.exe, wscript.exe for standard users" -ForegroundColor Yellow

# 6. HARDEN: Enable PowerShell Script Block Logging and Module Logging for .NET reflection detection
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Force | Out-Null
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name 'EnableScriptBlockLogging' -Value 1
Write-Host "[HARDEN] PowerShell Script Block Logging enabled" -ForegroundColor Green

# 7. HARDEN: Enforce SmartScreen for files and Edge
Set-MpPreference -EnableSmartScreen $true -ErrorAction SilentlyContinue
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Force | Out-Null
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Name 'EnableSmartScreen' -Value 1
Write-Host "[HARDEN] SmartScreen enforcement applied" -ForegroundColor Green