IO Cs Associated With Apt41s Malware Delivery Via Google Calendar
Query
let SHA256Hashes = dynamic(['469b534bec827be03c0823e72e7b4da0b84f53199040705da203986ef154406a', '3b88b3efbdc86383ee9738c92026b8931ce1c13cd75cd1cda2fa302791c2c4fb', '50124174a4ac0d65bf8b6fd66f538829d1589edc73aa7cf36502e57aa5513360', '151257e9dfda476cdafd9983266ad3255104d72a66f9265caa8417a5fe1df5d7']);
let Domains = dynamic(['word.msapp.workers.dev', 'cloud.msapp.workers.dev', 'term-restore-satisfied-hence.trycloudflare.com', 'ways-sms-pmc-shareholders.trycloudflare.com', 'resource.infinityfreeapp.com', 'pubs.infinityfreeapp.com']);
let URLs = dynamic(['https://lihi.cc/6dekU', 'https://lihi.cc/v3OyQ', 'https://lihi.cc/5nlgd', 'https://lihi.cc/edcOv', 'https://lihi.cc/4z5sh', 'https://tinyurl.com/mr42t4yv', 'https://tinyurl.com/hycev3y7', 'https://tinyurl.com/mpa2c5wj', 'https://tinyurl.com/3wnz46pv', 'https://my5353.com/ppOH5', 'https://my5353.com/nWyTf', 'https://my5353.com/fPUcX', 'https://my5353.com/ZwEkm', 'https://my5353.com/vEWiT', 'https://reurl.cc/WNr2Xy']);
EmailEvents
| where DeliveryLocation has "Inbox"
| join kind=inner (UrlClickEvents) on $left.NetworkMessageId == $right.NetworkMessageId
| join kind=inner (EmailAttachmentInfo) on $left.NetworkMessageId == $right.NetworkMessageId
| where SenderFromDomain has_any (Domains) or SenderMailFromDomain has_any (Domains) or Url has_any (URLs) or SHA256 has_any (SHA256Hashes)About this query
Explanation
This query is designed to detect potential malicious activities associated with a cyber threat campaign by APT41, a known threat actor. Here's a simplified breakdown of what the query does:
-
Context: The query is based on a scenario where APT41 uses spear phishing emails to deliver malware via Google Calendar. The emails contain links to a ZIP file hosted on a compromised site. The ZIP file includes a malicious LNK file that, when executed, deploys malware and uses Google Calendar for command and control.
-
Indicators of Compromise (IOCs): The query uses specific indicators such as SHA256 hashes, domains, and URLs that are known to be associated with the APT41 campaign.
-
Data Sources: The query examines email events, URL click events, and email attachment information to identify suspicious activities.
-
Filtering Criteria:
- It looks for emails delivered to the inbox.
- It joins data from URL click events and email attachment information based on a common identifier (NetworkMessageId).
- It checks if the sender's domain, the domain of the URL clicked, or the SHA256 hash of attachments match any of the known malicious indicators.
-
Objective: The goal is to identify emails that may be part of the APT41 campaign by checking if they contain known malicious links or attachments, or if they originate from suspicious domains. This helps in detecting and responding to potential security threats.
