Malicious Excel Delivery

Description

Bazacall uses malicious Excel files to execute payloads on affected devices.

Query · kql

DeviceFileEvents
| where FileOriginUrl has "/cancel.php" and FileOriginReferrerUrl has "/account"
  or FileOriginUrl has "/download.php" and FileOriginReferrerUrl has "/case"
Raw source Malicious Excel Delivery · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 6fa3cf44-517f-4ce5-8727-948b0783b507
name: Malicious Excel Delivery
description: |
  Bazacall uses malicious Excel files to execute payloads on affected devices.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
tactics:
- Initial access
query: |
  DeviceFileEvents
  | where FileOriginUrl has "/cancel.php" and FileOriginReferrerUrl has "/account"
    or FileOriginUrl has "/download.php" and FileOriginReferrerUrl has "/case"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.