Excel file download domain pattern

Description

BazaCall is a campaign that manipulate users into calling a customer support center, where they are instructed to download an Excel file to unsubscribe from a phony service. When the user opens the Excel file, they are prompted to enable a malicious macro that infects their device with BazaLoader. This query surfaces connections to the distinctive .xyz domains that the BazaCall campaign uses to host malicious Excel files.

Query · kql

DeviceNetworkEvents
| where RemoteUrl matches regex @".{14}\.xyz/config\.php"
Raw source Excel file download domain pattern · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 1dd47f50-d42d-4e2f-9c2b-6e6c22147916
name: Excel file download domain pattern
description: |
  BazaCall is a campaign that manipulate users into calling a customer support center, where they are instructed to download an Excel file to unsubscribe from a phony service. When the user opens the Excel file, they are prompted to enable a malicious macro that infects their device with BazaLoader.
  This query surfaces connections to the distinctive .xyz domains that the BazaCall campaign uses to host malicious Excel files.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceNetworkEvents
tactics:
- Initial access
query: |
  DeviceNetworkEvents
  | where RemoteUrl matches regex @".{14}\.xyz/config\.php"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.