Threat actor Phosphorus masquerading as conference organizers

id: 95510f90-597c-407e-bbe6-0e0319b456b0
name: Threat actor Phosphorus masquerading as conference organizers
description: |
  Identify prior activity from this campaign using IOCs shared by Microsoft's Threat Intelligence Center, or MSTIC.
  Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
- Initial access
query: |
  //All emails from the threat actor Phosphorus, masquerading as conference organizers, based on the IOCs shared 
  // by Microsoft's Threat Intelligence Center in: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
  let MaliciousSenders = dynamic(["t20saudiarabia@outlook.sa", "t20saudiarabia@hotmail.com", "t20saudiarabia@gmail.com", "munichconference@outlook.com",  
  "munichconference@outlook.de", "munichconference1962@gmail.com"]);
  EmailEvents
  | where SenderFromAddress  in~ (MaliciousSenders)