APT-C-36 (Blind Eagle) GitHub Loader Campaign: AsyncRAT, DcRat, Remcos & XWorm Deployment Pipeline — OTX Detection Pack

---
title: Blind Eagle AutoIt Loader Execution via WScript
description: Detects WScript/CScript executing script files with suspicious extensions or from user-writable staging paths, consistent with APT-C-36 (Blind Eagle) AutoIt/WScript loader delivery observed staging payloads from GitHub.
author: Security Arsenal Threat Intelligence
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_engine:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
  selection_args:
    CommandLine|contains:
      - '.txt'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Public\'
      - '\Downloads\'
  filter_legit:
    CommandLine|contains:
      - '\Program Files\'
      - '\Windows\System32\'
  condition: selection_engine and selection_args and not filter_legit
falsepositives:
  - Rare legitimate administrative scripting from temp paths
level: high
tags:
  - attack.execution
  - attack.t1059.005
  - attack.t1059.007
  - attack.t1204.002
date: 2026/09/28
---
title: Non-Developer Process Downloading Payload from GitHub Raw or Releases
description: Detects script interpreters, Office apps, or RAT-stage tooling retrieving content from GitHub raw content or release asset URLs - Blind Eagle (APT-C-36) stages AsyncRAT, DcRat, Remcos and XWorm payloads in GitHub repositories.
author: Security Arsenal Threat Intelligence
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_url:
    CommandLine|contains:
      - 'raw.githubusercontent.com'
      - 'github.com'
      - 'objects.githubusercontent.com'
  selection_suspicious_parent:
    ParentImage|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\winword.exe'
      - '\excel.exe'
      - '\rundll32.exe'
  condition: all of selection_*
falsepositives:
  - Developer workstations and software update mechanisms using GitHub releases; scope exclusions by parent process or user context
level: high
tags:
  - attack.command_and_control
  - attack.t1105
  - attack.t1071.001
date: 2026/09/28
---
title: AsyncRAT / DcRat Persistence via Registry Run Key or Scheduled Task
description: Detects persistence creation in Run keys or scheduled tasks pointing to user-writable paths, a common persistence pattern for AsyncRAT, DcRat, Remcos and XWorm deployed by APT-C-36 operators.
author: Security Arsenal Threat Intelligence
status: experimental
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\CurrentVersion\Run\'
      - '\CurrentVersion\RunOnce\'
  selection_value:
    Details|contains:
      - '\AppData\'
      - '\Temp\'
      - '\Public\'
      - '\ProgramData\'
  filter_known_good:
    Details|contains:
      - 'OneDrive'
      - 'MicrosoftEdge'
      - 'Teams'
  condition: selection_key and selection_value and not filter_known_good
falsepositives:
  - Legitimate user-context applications registering autostart entries; tune against an enterprise software baseline
level: high
tags:
  - attack.persistence
  - attack.t1060
  - attack.t1547.001
date: 2026/09/28

// Blind Eagle (APT-C-36) Hunt: IOC matching + behavioral pivots for GitHub-staged RAT loaders
// Microsoft Sentinel / Defender XDR - run over last 30 days

let BlindEagleIoCs = dynamic([
    "data-encoder.com",
    "creainovada.xyz",
    "consultanotificacionesjuridicas.site",
    "simpmit.co",
    "dccomicrat81.duckdns.org"
]);
let Lookback = 30d;

// Part 1: Direct IOC hits in network telemetry
let NetworkHits = DeviceNetworkEvents
| where Timestamp > ago(Lookback)
| where RemoteUrl has_any (BlindEagleIoCs) or RemoteIP in (
    // enrich via your threat intel connector if IPs are resolved separately
    toscalar(DeviceNetworkEvents | where Timestamp > ago(Lookback)
        | where RemoteUrl has_any (BlindEagleIoCs) | distinct RemoteIP)
)
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| extend MatchType = "Direct IOC Network Hit";

// Part 2: DNS resolution of DuckDNS dynamic DNS (DcRat C2 pattern)
let DuckDnsHits = DeviceNetworkEvents
| where Timestamp > ago(Lookback)
| where RemoteUrl endswith ".duckdns.org"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl
| extend MatchType = "Dynamic DNS C2 Pattern";

// Part 3: Script interpreters pulling payloads from GitHub (loader staging behavior)
let GitHubStagerHits = DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where FileName in~ ("wscript.exe", "cscript.exe", "mshta.exe", "powershell.exe", "cmd.exe", "rundll32.exe")
| where ProcessCommandLine has_any ("raw.githubusercontent.com", "github.com", "githubusercontent.com")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName
| extend MatchType = "GitHub Payload Staging via Script Interpreter";

// Part 4: WScript executing .txt-renamed scripts (Blind Eagle Wscript.txt tradecraft)
let TxtScriptHits = DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where FileName in~ ("wscript.exe", "cscript.exe")
| where ProcessCommandLine has ".txt"
| project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName
| extend MatchType = "WScript Executing .txt Script";

union NetworkHits, DuckDnsHits, GitHubStagerHits, TxtScriptHits
| sort by Timestamp desc

# Blind Eagle (APT-C-36) Endpoint IOC & Artifact Hunt
# Checks for: campaign IOCs in DNS cache, Run-key persistence in user-writable paths,
# suspicious scheduled tasks, AutoIt/WScript staging artifacts, and active C2 connections.
# Run elevated on suspect endpoints. Review output before taking remediation action.

$Report = @()

Write-Host "[*] Checking DNS cache for campaign IOCs..." -ForegroundColor Cyan
$iocDomains = @("data-encoder.com","creainovada.xyz","consultanotificacionesjuridicas.site","simpmit.co","dccomicrat81.duckdns.org")
$dnsHits = Get-DnsClientCache | Where-Object { $e = $_.Entry; $iocDomains | Where-Object { $e -like "*$_*" } }
if ($dnsHits) { $Report += "[ALERT] DNS cache IOC hit:`n$($dnsHits | Out-String)" }

Write-Host "[*] Auditing Run / RunOnce persistence keys..." -ForegroundColor Cyan
$runKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key | ForEach-Object {
            $_.PSObject.Properties | Where-Object {
                $_.Name -notmatch '^PS' -and $_.Value -match 'AppData|Temp|Public|ProgramData|\.txt|wscript|\.a3x'
            } | ForEach-Object {
                $Report += "[ALERT] Suspicious autostart: $key :: $($_.Name) = $($_.Value)"
            }
        }
    }
}

Write-Host "[*] Auditing scheduled tasks for user-path execution..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.State -ne 'Disabled' } | ForEach-Object {
    $actions = ($_.Actions | Out-String)
    if ($actions -match 'AppData|Temp\|wscript|cscript|\.a3x|powershell.*-enc') {
        $Report += "[ALERT] Suspicious scheduled task: $($_.TaskName) :: $actions"
    }
}

Write-Host "[*] Searching common staging directories for AutoIt/WScript artifacts..." -ForegroundColor Cyan
$stagingPaths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:PUBLIC","$env:USERPROFILE\Downloads")
foreach ($p in $stagingPaths) {
    Get-ChildItem $p -Recurse -Depth 2 -ErrorAction SilentlyContinue |
        Where-Object { $_.Extension -in '.a3x','.txt','.vbs','.js' -and $_.Length -gt 50KB } |
        ForEach-Object { $Report += "[REVIEW] Possible staged script: $($_.FullName) ($([math]::Round($_.Length/1KB)) KB)" }
}

Write-Host "[*] Checking active connections to dynamic DNS / known C2..." -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemotePort -in 6666,7777,8808,11778 -or $_.OwningProcess -in (Get-Process wscript,cscript,AutoIt3 -ErrorAction SilentlyContinue).Id } |
    ForEach-Object {
        $proc = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName
        $Report += "[REVIEW] Connection: $proc ($($_.OwningProcess)) -> $($_.RemoteAddress):$($_.RemotePort)"
    }

Write-Host "`n===== HUNT RESULTS =====" -ForegroundColor Yellow
if ($Report.Count -eq 0) { Write-Host "[+] No Blind Eagle artifacts detected on this host." -ForegroundColor Green }
else { $Report | ForEach-Object { Write-Host "$_`n" -ForegroundColor Red } }