---
title: Blind Eagle AutoIt Loader Execution with Suspicious Child Process
id: 9f3a2c71-4b1e-4d5a-9e02-7a1c6f8b2d11
status: experimental
description: Detects AutoIt interpreter executing scripts from user-writable directories followed by RAT-consistent child processes, consistent with APT-C-36 (Blind Eagle) GitHub loader delivery of AsyncRAT, DcRat, Remcos, or XWorm.
author: Security Arsenal Threat Intelligence
references:
  - https://www.levelblue.com/blogs/spiderlabs-blog/still-circling-inside-the-operator-behind-blind-eagles-github-loader
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_autoit:
    Image|endswith:
      - '\AutoIt3.exe'
      - '\AutoIt3_x64.exe'
    CommandLine|contains:
      - '\AppData\'
      - '\ProgramData\'
      - '\Temp\'
  selection_child:
    ParentImage|endswith:
      - '\AutoIt3.exe'
      - '\AutoIt3_x64.exe'
    Image|endswith:
      - '\msbuild.exe'
      - '\csc.exe'
      - '\regasm.exe'
      - '\regsvcs.exe'
      - '\rundll32.exe'
      - '\powershell.exe'
      - '\cmd.exe'
  condition: selection_autoit or selection_child
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1218
  - apt.apt_c_36
falsepositives:
  - Legitimate enterprise AutoIt automation scripts
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
date: 2026/08/31
---
title: RAT Persistence via Registry Run Key in User Directory
id: 2e7b91d4-8c3f-4a60-b511-3d9e5f6a7c22
status: experimental
description: Detects registry Run key persistence entries pointing to executables in user-writable paths, a standard persistence mechanism for AsyncRAT, Remcos, XWorm, and DcRat deployed by Blind Eagle.
author: Security Arsenal Threat Intelligence
references:
  - https://otx.alienvault.com/
logsource:
  category: registry_set
  product: windows
  service: sysmon
detection:
  selection_key:
    TargetObject|contains:
      - '\Software\Microsoft\Windows\CurrentVersion\Run'
      - '\Software\Microsoft\Windows\CurrentVersion\RunOnce'
  selection_path:
    Details|contains:
      - '\AppData\Roaming\'
      - '\AppData\Local\'
      - '\ProgramData\'
      - '%TEMP%'
  filter_legit:
    Details|contains:
      - 'OneDrive'
      - 'Teams'
      - 'Slack'
  condition: selection_key and selection_path and not filter_legit
level: high
tags:
  - attack.persistence
  - attack.t1060
  - attack.t1547.001
falsepositives:
  - User-installed applications registering autostart entries
date: 2026/08/31
---
title: GitHub Actions issue_comment Trigger Without Author Association Gate
id: 5c1d8e92-7f4a-4b33-9d06-1a2b3c4d5e33
status: experimental
description: Detects CI/CD pipeline risk consistent with the Mini Shai-Hulud npm supply chain compromise - GitHub Actions workflows using issue_comment triggers that allow fork-based workflow execution leading to package publishing.
author: Security Arsenal Threat Intelligence
references:
  - https://safedep.io/mini-shai-hulud-openapi-react-query-codegen-compromised/
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\.github\workflows\'
  selection_content:
    TargetFilename|endswith:
      - '.yml'
      - '.yaml'
  condition: selection_path and selection_content
level: informational
tags:
  - attack.initial_access
  - attack.t1195.001
falsepositives:
  - Any legitimate workflow file modification - use as audit enrichment for CI security review
date: 2026/08/31

// Hunt for Blind Eagle RAT C2 communication and phishing infrastructure
let ioc_domains = dynamic(["data-encoder.com", "creainovada.xyz", "consultanotificacionesjuridicas.site", "simpmit.co", "dccomicrat81.duckdns.org"]);
let ioc_ips = dynamic(["64.89.160.17"]);
let networkHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl in (ioc_domains) or RemoteIP in (ioc_ips)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort;
let dnsHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has_any (ioc_domains) or RemoteUrl endswith ".duckdns.org"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl;
// AutoIt loader execution from user-writable paths
let autoitExec = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName =~ "AutoIt3.exe" or FileName =~ "AutoIt3_x64.exe"
| where ProcessCommandLine has_any ("AppData", "ProgramData", "Temp")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName;
union networkHits, dnsHits, autoitExec
| sort by TimeGenerated desc

# Security Arsenal - Blind Eagle / RAT IOC Hunt Script
# Checks registry persistence, suspicious AutoIt artifacts, and C2 connections

Write-Host "=== Blind Eagle / AsyncRAT-XWorm Hunt ===" -ForegroundColor Cyan

# 1. Registry Run key persistence pointing to user-writable paths
$runKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key | Get-Member -MemberType NoteProperty | ForEach-Object {
            $value = (Get-ItemProperty $key).($_.Name)
            if ($value -match "AppData|ProgramData|Temp|AutoIt") {
                Write-Host "[PERSISTENCE] $key :: $($_.Name) = $value" -ForegroundColor Red
            }
        }
    }
}

# 2. AutoIt scripts and compiled artifacts in user directories
$suspectPaths = @("$env:APPDATA", "$env:LOCALAPPDATA", "$env:ProgramData", "$env:TEMP")
foreach ($path in $suspectPaths) {
    Get-ChildItem -Path $path -Recurse -Include *.au3, *.a3x, AutoIt3*.exe -ErrorAction SilentlyContinue |
        Select-Object -First 20 | ForEach-Object {
            Write-Host "[AUTOIT ARTIFACT] $($_.FullName) (Modified: $($_.LastWriteTime))" -ForegroundColor Yellow
        }
}

# 3. Active connections to known RAT C2
$c2Indicators = @("64.89.160.17", "dccomicrat81.duckdns.org")
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    if ($c2Indicators -contains $_.RemoteAddress) {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        Write-Host "[C2 CONNECTION] $($_.RemoteAddress):$($_.RemotePort) via $($proc.ProcessName) (PID $($_.OwningProcess))" -ForegroundColor Red
    }
}

# 4. DNS cache check for lure/C2 domains
$dnsIndicators = @("data-encoder.com", "creainovada.xyz", "consultanotificacionesjuridicas.site", "simpmit.co")
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($ioc in $dnsIndicators) {
    $hit = $dnsCache | Where-Object { $_.Entry -like "*$ioc*" }
    if ($hit) { Write-Host "[DNS CACHE HIT] $ioc resolved on this host" -ForegroundColor Red }
}

# 5. npm artifact check for Mini Shai-Hulud hashes (developer machines)
$npmCache = "$env:LOCALAPPDATA\npm-cache"
$badHashes = @("b24d121667f21f492cb9db34fbfd515d5922a8dd30b9c45215c7220abbb10ca8", "b49afb7dba04cd99b357ce7c652c823a3707f28e130bd5c6645851a7adc030d6")
if (Test-Path $npmCache) {
    Get-ChildItem $npmCache -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($badHashes -contains $h.ToLower()) {
            Write-Host "[MALICIOUS NPM ARTIFACT] $($_.FullName) SHA256=$h" -ForegroundColor Red
        }
    }
}

Write-Host "=== Hunt Complete ===" -ForegroundColor Cyan