Malicious Senders Hidden Behind Anonymous Proxies

Query

CloudAppEvents
| where IsAnonymousProxy == 1
| where Application contains "Exchange"
| where ActionType contains "TIMailData-Inline"
| where RawEventData.DeliveryAction contains "Delivered"
| project IPAddress, CountryCode, City, ISP, RawEventData.Subject,RawEventData.P2Sender, RawEventData.DeliveryAction, RawEventData.Verdict, ActionType, Application

About this query

MITRE ATT&CK Technique(s)

Technique ID	Title
T1566.002	Phishing: Spearphishing Link
T1090.003	Proxy: Multi-hop Proxy

Author: Sergio Albea (02/08/2024)

Malicious Senders hidden behind anonymous proxies

I had pending to have a deep view into the CloudAppEvents table and finally I had some time over the weekend to have a look around. I will have an interesting work to look for the cases where the attackers are using Anonymous Proxy. To start, let's catch some "GhostHackers" that thinks that being hidden behind a proxy, they will not be hunted sending malicious emails.

Explanation

This query is designed to identify instances where malicious actors are using anonymous proxies to send emails through Exchange applications. Here's a simple breakdown of what the query does:

Data Source: The query examines the CloudAppEvents table, which contains logs of cloud application activities.
Filter for Anonymous Proxies: It specifically looks for events where the IsAnonymousProxy field is set to 1, indicating that the activity is coming from an anonymous proxy.
Focus on Exchange: The query filters for activities related to the "Exchange" application, which is commonly used for email services.
Email Action Type: It further narrows down the results to actions related to "TIMailData-Inline," which suggests inline email data processing.
Delivered Emails: The query checks for emails that have been delivered, as indicated by the RawEventData.DeliveryAction containing "Delivered."
Output: The query projects (selects) specific fields to display in the results, including:
- IPAddress: The IP address of the sender.
- CountryCode and City: The geographical location of the sender.
- ISP: The Internet Service Provider used by the sender.
- RawEventData.Subject: The subject of the email.
- RawEventData.P2Sender: The sender's email address.
- RawEventData.DeliveryAction: The action taken on the email (e.g., delivered).
- RawEventData.Verdict: The security verdict on the email.
- ActionType and Application: The type of action and the application involved.

In summary, this query is used to detect and analyze emails sent through anonymous proxies, potentially by malicious actors, using Exchange services. It helps identify the source and details of such emails, which can be crucial for cybersecurity investigations.

KQL Search