---
title: Potential APT-C-36 AutoIt RunPE Loader Execution
id: 8f3a2c1b-6d4e-4a9f-b8c2-1d3e5f7a9b0c
description: Detects the execution of AutoIt3 interpreter loading suspicious binaries or scripts, often used by APT-C-36 for RunPE loading.
status: experimental
date: 2026/07/20
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\autoit3.exe'
      - '\autoit3_x64.exe'
  filter_legit:
    CommandLine|contains:
      - 'AutoIt3.exe'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate administrative scripts
level: high
tags:
  - attack.execution
  - attack.t1059.001
  - apt-c-36
---
title: Suspicious Vishing Domain Request (Passkey Enrollment)
id: 2a5b8d9e-1f4c-4a7e-9b3c-6d8f9a1b2c3d
description: Detects DNS queries for domains containing 'passkey' keywords not associated with legitimate Microsoft Entra ID infrastructure, indicative of O-UNC-066 activity.
status: experimental
date: 2026/07/20
author: Security Arsenal
logsource:
  category: dns_query
  product: windows
detection:
  keywords:
    QueryName|contains:
      - 'passkey'
      - 'enroll'
  filter_legit:
    QueryName|contains:
      - 'microsoft.com'
      - 'msauth.net'
      - 'azure.net'
  condition: keywords and not filter_legit
falsepositives:
  - Legitimate internal passwordless authentication tools
level: medium
tags:
  - attack.initial_access
  - attack.social_engineering
  - o-unc-066
---
title: APT-C-36 RAT Persistence via Photo Studio
id: 4c7d6e8f-9a0b-1c2d-3e4f-5a6b7c8d9e0f
description: Detects the creation of scheduled tasks or registry keys associated with the 'Photo Studio' persistence mechanism used by Blind Eagle.
status: experimental
date: 2026/07/20
author: Security Arsenal
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - '\Photo Studio'
      - '\PhotoStudio'
  condition: selection
falsepositives:
  - Legitimate photo software installation
level: high
tags:
  - attack.persistence
  - attack.t1543.003
  - apt-c-36


kql
// Hunt for APT-C-36 C2 Connections and File Hashes
// DeviceNetworkEvents for C2 IPs and suspicious Hostnames
DeviceNetworkEvents
| where RemoteIP in ("178.16.52.80", "64.89.160.17", "181.235.8.24")
   or RemoteUrl has "rema200426.duckdns.org"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl, RemotePort
;
// DeviceFileEvents for malware hashes
DeviceFileEvents
| where SHA256 in ("a4fbd707f4ce7ca68e6137cef1c56b6f408e5f0a0f148434d996bb98c3a21fff", "a73cb9d5d46e19f3daa4a14cfe5d8fa4319a3d62452039e4972e6a316bbb26f4")
| project Timestamp, DeviceName, FolderPath, SHA256, InitiatingProcessAccountName
;
// DeviceProcessEvents for AutoIt execution
DeviceProcessEvents
| where ProcessVersionInfoOriginalFileName =~ "AutoIt3.exe" or FileName =~ "autoit3.exe"
| project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessFileName


powershell
# IOC Hunt Script for APT-C-36 Persistence and Hashes
# Requires Admin Privileges

Write-Host "[*] Hunting for APT-C-36 Persistence and IOCs..." -ForegroundColor Cyan

# 1. Check for File Hashes
$maliciousHashes = @(    "a4fbd707f4ce7ca68e6137cef1c56b6f408e5f0a0f148434d996bb98c3a21fff",
    "a73cb9d5d46e19f3daa4a14cfe5d8fa4319a3d62452039e4972e6a316bbb26f4"
)

$pathsToScan = @("C:\Users\", "C:\ProgramData\", "C:\Windows\Temp\")

foreach ($path in $pathsToScan) {
    if (Test-Path $path) {
        Write-Host "[+] Scanning $path for malicious hashes..." -ForegroundColor Yellow
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($maliciousHashes -contains $hash) {
                Write-Host "[!!!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

# 2. Check for 'Photo Studio' Persistence in Registry (Run Keys)
$runKeys = @(    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

Write-Host "[+] Checking Registry for 'Photo Studio' persistence..." -ForegroundColor Yellow
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-Item -Path $key | Select-Object -ExpandProperty Property | ForEach-Object {
            if ($_ -like "*Photo Studio*" -or $_ -like "*PhotoStudio*") {
                $value = (Get-ItemProperty -Path $key -Name $_).$_
                Write-Host "[!!!] SUSPICIOUS PERSISTENCE FOUND: Key=$key, Name=$_, Value=$value" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[*] Hunt complete." -ForegroundColor Green


# Response Priorities

**Immediate (0-4 hours):**
*   Block all listed IPv4 IOCs (`178.16.52.80`, `64.89.160.17`, `181.235.8.24`) at the firewall.
*   Sinkhole all 'passkey' related domains (`deploypasskey.com`, etc.) and the DuckDNS hostname.
*   Isolate any endpoints where the malicious file hashes are detected.

**24 Hours:**
*   Conduct a thorough hunt for the 'Photo Studio' persistence mechanism across the enterprise using the provided PowerShell script.
*   Audit Microsoft Entra ID sign-in logs for recent "Passkey" registration events, specifically looking for registrations initiated from unusual IPs or devices not managed by the organization.
*   Review call logs or VoIP data for potential vishing attempts if call recording is available.

**1 Week:**
*   Update user awareness training to specifically include vishing tactics targeting MFA/Passkey enrollment.
*   Implement technical controls requiring Manager or IT approval/approval workflows for new passkey enrollment in Entra ID.
*   Review GitHub usage policies and egress filtering to prevent abuse of developer platforms for malware staging.