Star Blizzard-Domain IOCs

id: 4b14590a-a1f0-4756-9f3d-baafa696e051
name: Star Blizzard-Domain IOCs
description: |
  'This query identifies matches based on domain IOCs related to Star Blizzard against Microsoft Defender for Endpoint device network connections'
severity: High
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceNetworkEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let IOCs_Domains = pack_array("cache-dns.com","cache-dns-forwarding.com","cache-dns-preview.com","cache-docs.com","cache-pdf.com","cache-pdf.online","cache-services.live",
                                "cloud-docs.com","cloud-drive.live","cloud-storage.live","docs-cache.com","docs-forwarding.online","docs-info.com","docs-shared.com",
                                "docs-shared.online","docs-view.online","document-forwarding.com","document-online.live","document-preview.com","documents-cloud.com",
                                "documents-cloud.online","documents-forwarding.com","document-share.live","documents-online.live","documents-pdf.online","documents-preview.com",
                                "documents-view.live","document-view.live","drive-docs.com","drive-share.live","goo-link.online","hypertextteches.com","mail-docs.online",
                                "officeonline365.live","online365-office.com","online-document.live","online-storage.live","pdf-cache.com","pdf-cache.online","pdf-docs.online",
                                "pdf-forwarding.online","protection-checklinks.xyz","protection-link.online","protectionmail.online","protection-office.live","protect-link.online",
                                "proton-docs.com","proton-reader.com","proton-viewer.com","relogin-dashboard.online","safe-connection.online","safelinks-protect.live","secureoffice.live",                                
                                "webresources.live","word-yand.live","yandx-online.cloud","y-ml.co","docs-drive.online","docs-info.online","cloud-mail.online","onlinecloud365.live",
                                "pdf-cloud.online","pdf-shared.online","proton-pdf.online","proton-view.online","cloud-mail.online","office365-online.live","doc-viewer.com",
                                "file-milgov.systems","office-protection.online");
  DeviceNetworkEvents 
  | where RemoteUrl has_any(IOCs_Domains)