Threat actor Phosphorus masquerading as conference organizers (1)

Description

Identify prior activity from this campaign using IOCs shared by Microsoft's Threat Intelligence Center, or MSTIC. Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/

Query · kql

//Filter for emails that were delivered check the FinalEmailAction to see if there was policy applied on this email
let MaliciousSenders = dynamic(["t20saudiarabia@outlook.sa", "t20saudiarabia@hotmail.com", "t20saudiarabia@gmail.com", "munichconference@outlook.com",  
"munichconference@outlook.de", "munichconference1962@gmail.com"]);
EmailEvents
| where SenderFromAddress  in~ (MaliciousSenders) and DeliveryAction == "Delivered"
Raw source Threat actor Phosphorus masquerading as conference organizers (1) · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 32f927f2-b1f3-441b-8885-bd66404e091d
name: Threat actor Phosphorus masquerading as conference organizers (1)
description: |
  Identify prior activity from this campaign using IOCs shared by Microsoft's Threat Intelligence Center, or MSTIC.
  Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
- Initial access
query: |
  //Filter for emails that were delivered check the FinalEmailAction to see if there was policy applied on this email
  let MaliciousSenders = dynamic(["t20saudiarabia@outlook.sa", "t20saudiarabia@hotmail.com", "t20saudiarabia@gmail.com", "munichconference@outlook.com",  
  "munichconference@outlook.de", "munichconference1962@gmail.com"]);
  EmailEvents
  | where SenderFromAddress  in~ (MaliciousSenders) and DeliveryAction == "Delivered"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.