Blind Eagle AsyncRAT Campaigns & Entra Passkey Vishing: OTX Pulse Analysis

title: Potential APT-C36 AutoIt RunPE Loader Activity
id: 4e8f9a2b-1c3d-4f5e-9a6b-3c7d8e9f0a1b
description: Detects execution of AutoIt3 interpreter loading suspicious binaries or performing process hollowing indicative of Blind Eagle RunPE techniques.
status: experimental
date: 2026/07/20
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6123456789
tags:
    - attack.execution
    - attack.t1059.005
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\\AutoIt3.exe'
        CommandLine|contains:
            - '/ErrorStdOut'
            - 'RunPE'
    condition: selection
falsepositives:
    - Legitimate AutoIt script execution
level: high
---
title: Suspicious Entra Passkey Phishing Domain Connection
id: 5b9g0b3c-2d4e-0g6b-4b7c-0d8e0f1a2b3c
description: Detects network connections to domains associated with O-UNC-066 vishing campaigns targeting Microsoft Entra passkeys.
status: experimental
date: 2026/07/20
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6123456790
tags:
    - attack.initial_access
    - attack.social_engineering
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|contains:
            - 'deploypasskey'
            - 'passkeyadd'
            - 'passkeydeploy'
            - 'setpasskey'
            - 'assignpasskey'
    condition: selection
falsepositives:
    - Rare; legitimate passkey management URLs usually use microsoft.com or valid enterprise domains.
level: critical
---
title: AsyncRAT Chrome Credential Theft Pattern
id: 6c0h1c4d-3e5f-1h7c-5c8d-1e9f0g2b3c4d
description: Detects process access patterns typical of AsyncRAT and njRAT variants stealing Chrome login data.
status: experimental
date: 2026/07/20
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6123456789
tags:
    - attack.credential_access
    - attack.t1003
logsource:
    category: process_access
    product: windows
detection:
    selection:
        SourceImage|endswith:
            - '\\AutoIt3.exe'
            - '\\powershell.exe'
            - '\\cmd.exe'
        TargetImage|contains: '\\chrome.exe'
        GrantedAccess: '0x1010'
    condition: selection
falsepositives:
    - Administrative tools accessing browser data for debugging.
level: high


kql
// Hunt for network connections to known IOCs and suspicious passkey domains
let IOCs = dynamic(["178.16.52.80", "64.89.160.17", "181.235.8.24", "deploypasskey.com", "passkeyadd.com", "passkeydeploy.com", "setpasskey.com", "assignpasskey.com", "rema200426.duckdns.org"]);
DeviceNetworkEvents
| where RemoteUrl in (IOCs) or RemoteIP in (IOCs) or DeviceName in ("rema200426.duckdns.org")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| extend HuntType = case(RemoteUrl contains "passkey", "Passkey_Phishing", RemoteIP has_any ("178.16", "64.89", "181.235"), "RAT_C2", "Other")
| order by Timestamp desc


powershell
# IOC Hunt Script for Blind Eagle Components
$MaliciousHashes = @(    "a4fbd707f4ce7ca68e6137cef1c56b6f408e5f0a0f148434d996bb98c3a21fff",
    "a73cb9d5d46e19f3daa4a14cfe5d8fa4319a3d62452039e4972e6a316bbb26f4"
)

Write-Host "[+] Scanning for Blind Eagle IOCs..." -ForegroundColor Cyan

# 1. Scan for specific file hashes
Write-Host "[*] Checking filesystem for known malicious hashes..." -ForegroundColor Yellow
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { $_.Length -gt 0kb -and $_.Length -lt 10mb } | 
    ForEach-Object {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($MaliciousHashes -contains $hash) {
            Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
        }
    }

# 2. Check for AutoIt3.exe in unusual locations (often dropped with the malware)
Write-Host "[*] Checking for suspicious AutoIt3 executions..." -ForegroundColor Yellow
$autoit = Get-Process -Name "AutoIt3" -ErrorAction SilentlyContinue
if ($autoit) {
    $autoit | ForEach-Object {
        Write-Host "[!] AutoIt3 Process Running PID: $($_.Id), Path: $($_.Path)" -ForegroundColor Yellow
    }
}

# 3. Check for persistence via scheduled tasks (common with Bladabindi/AsyncRAT)
Write-Host "[*] Checking Suspicious Scheduled Tasks..." -ForegroundColor Yellow
Get-ScheduledTask | Where-Object { $_.Actions.Execute -like "*wscript*" -or $_.Actions.Execute -like "*mshta*" } | 
    Select-Object TaskName, TaskPath, State | Format-Table