referral-phish-emails

Description

Hunting for credential phishing using the "Referral" infrastructure using Defender for Office 365 data

Query · kql

let EmailAddresses = pack_array
('zreffertalt.com.com','zreffesral.com.com','kzreffertal.com.com',
'wzreffertal.com.com','refferal.comq','refferal.net','zreffertal.com.com',
'zrefferal.com.com','refferasl.com.com','zreffesral.com','zrefsfertal.com.com',
'irefferal.com','refferasl.co','zrefferal.com');
EmailEvents
| where SenderMailFromDomain in (EmailAddresses)
| extend RecipientDomain = extract("[^@]+$", 0, RecipientEmailAddress)
| where SenderFromDomain == RecipientDomain
| join EmailUrlInfo on $left.NetworkMessageId == $right.NetworkMessageId
Raw source referral-phish-emails · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: cdc4da1c-64a1-4941-be59-1f5cc85481ab
name: referral-phish-emails
description: |
  Hunting for credential phishing using the "Referral" infrastructure using Defender for Office 365 data
description-detailed: |
  The "Referral" infrastructure is a point-in-time set of infrastructure associated with spoofed emails that imitate SharePoint and other legitimate products to conduct credential phishing. The operator is also known to use legitimate URL infrastructure such as Google, Microsoft, and Digital Ocean to host their phishing pages.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
  - EmailUrlInfo
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let EmailAddresses = pack_array
  ('zreffertalt.com.com','zreffesral.com.com','kzreffertal.com.com',
  'wzreffertal.com.com','refferal.comq','refferal.net','zreffertal.com.com',
  'zrefferal.com.com','refferasl.com.com','zreffesral.com','zrefsfertal.com.com',
  'irefferal.com','refferasl.co','zrefferal.com');
  EmailEvents
  | where SenderMailFromDomain in (EmailAddresses)
  | extend RecipientDomain = extract("[^@]+$", 0, RecipientEmailAddress)
  | where SenderFromDomain == RecipientDomain
  | join EmailUrlInfo on $left.NetworkMessageId == $right.NetworkMessageId
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.