AsyncRAT - Drive Letter Iteration Batch Script (T1082)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•7

Detects the batch stager iterating through all possible drive letters to locate the mounted USB/ISO drive containing the hidden payload. This rule specifically looks for 'cmd.exe' processes executing a command line that includes a 'for' loop iterating through drive letters A through G.