Blind Eagle JC-46 Script-to-PowerShell/AutoIt3 Delivery Chain

Duo Tech@duotech

•updated Jul 23, 2026•1•0•1

Detects suspicious delivery and execution chains characteristic of the Blind Eagle (APT-C-36) group. The rule monitors for WScript, CScript, or CMD processes spawning PowerShell with evasive flags (hidden, bypass, encoded, etc.) accessing suspicious file paths, or the execution of a renamed AutoIt3 binary from non-standard locations like Temp or AppData, which are common indicators of stage-two downloader activity.